Cloudanix VulnDB

CVE-2026-90248

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux kernel's network traffic filtering code can cause active rules to be silently removed when multiple changes happen at once, potentially disrupting network behavior.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in tc_new_tfilter allows a losing insert request to call tcf_chain_tp_delete_empty on a proto owned by a concurrent winning request, silently removing an active classifier that was already advertised.

Why it matters to the business

Network traffic classification and QoS rules can be silently dropped under concurrent filter operations, causing unexpected packet handling changes, potential kernel instability, or service disruption on systems managing complex tc configurations.

How an attack unfolds

An attacker with local access to issue concurrent RTM_NEWTFILTER netlink requests against the same chain and priority triggers the insert race in tcf_chain_tp_insert_unique; the loser path incorrectly tears down the winner's live proto, removing advertised classifiers without notification.

How to fix it

Update the Linux kernel to a version containing the referenced cls_api fix that replaces the tp_created flag with a tri-state TP_NOT_CREATED/TP_CREATED/TP_NOT_OWNED variable and ensures correct errout handling for adopted protos.

How to confirm the fix worked

Confirm the kernel source contains the tri-state outcome tracking logic in tc_new_tfilter and tcf_chain_tp_insert_unique; test by exercising concurrent filter insertions and verifying no active classifier is unlinked.

Typical attack path

  1. Obtain local access or capability to execute tc or netlink operations on the target host
  2. Issue multiple simultaneous classifier insertion requests targeting identical chain/prio values
  3. Win the race so the victim's proto is adopted then deleted by the losing request's errout path
  4. Observe removal of active filters via RTM_NEWTFILTER notifications or traffic behavior change

How to detect it

Review kernel logs for tcf_chain_tp_delete_empty calls on protos that were concurrently inserted; inspect netlink audit records for rapid RTM_NEWTFILTER sequences on the same chain/prio and any resulting classifier disappearance events.

What your security team should do

  • Prioritize kernel updates on any system exposing tc filter management to untrusted users or automation
  • Restrict unprivileged netlink access via capabilities or SELinux/AppArmor policy until patched
  • Monitor for kernel oops or tc filter removal events in high-churn environments

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted proto on insert-race loss In tc_new_tfilter() the create branch sets tp_created = 1 before calling tcf_chain_tp_insert_unique(). When the caller loses the race (another request inserted a proto at the same chain/prio first), insert_unique() destroys the caller's own tp_new and returns the winner's proto with an extra reference. tp_created was never cleared, so the loser's errout path treated the winner's live proto as its own and called tcf_chain_tp_delete_empty() on it, silently unlinking an active classifier that the winning request already advertised via RTM_NEWTFILTER. Track the outcome of the insert step in a single tri-state variable so each errout path reacts correctly: - TP_NOT_CREATED: no proto created; pursue the old path. - TP_CREATED: proto inserted successfully; same code path as before. - TP_NOT_OWNED: New - lost the insert race; tp is another request's proto (chain ref already released by tp_new's destroy) Both errout reactions are single expressions derived from the state. This fix is motivated by the Sashiko's automated review of Patch (net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers) [1][2]. The review identified the silent-unlink behaviour of an adopted proto's teardown when a request loses the tcf_chain_tp_insert_unique() race. [1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com

Affected packages

Ecosystem Package Introduced Fixed