---
id: "CVE-2026-98811"
kind: "vulnerability"
aliases: ["CVE-2026-98811"]
title: "Linux kernel: failed tc filter adds leave an empty classifier linked"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "networking", "tc"]
not_affected_if: ["flower-not-enabled", "no-untrusted-local-users"]
published_at: "2026-10-18T16:17:35+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:14:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98811", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: failed tc filter adds leave an empty classifier linked

Two racing tc filter add requests on the same chain and priority can leave an empty classifier proto linked in the kernel after both fail, holding references to the chain, block and classifier module. The sources describe a resource leak rather than code execution or privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare with the fixed kernel in the NVD record or your distribution's advisory
- `tc filter show dev <iface> ingress` and look for a bare `filter protocol ip pref 1 flower chain 0` header with no filter entries
- Confirm whether `CONFIG_NET_CLS_FLOWER` is enabled in your kernel config

## Fix

- Update the Linux kernel to a build that includes the cls_api fix (unknown version in the sources)
- Reboot into the patched kernel, since the fix is in the running kernel only after restart
- Until patched, avoid running concurrent tc filter add requests on the same chain and priority

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98811

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: reclaim an empty proto on the error path

Two racing tc filter add requests on the same chain/prio of an
unlocked classifier both run change() on the shared proto and both
can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up
because the loser's handle is still in the idr, and the loser's
error path drops only its own reference without a second reclamation
attempt. The empty proto stays linked in the chain, holding the
chain reference, a block reference and the classifier module
reference until the chain or block is torn down.

Reclaim the proto on the error path of any failed request that holds
a proto reference. The reclamation is emptiness-gated:
tcf_chain_tp_delete_empty() unlinks the proto only when
delete_empty() admits it is empty, so a live shared proto is never
unlinked. A proto the request created is reclaimed unconditionally -
it is the only owner, so marking it for deletion is safe even without
a delete_empty callback. Classifiers without one (the check marks the
proto unconditionally) are rtnl-serialized, so the raced window this
guard closes cannot arise for them.

This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix
teardown of an adopted proto on insert-race loss"), which stopped the
loser of the insert race from unlinking the winner's live proto but
left the empty-proto residual in place.

Conditions to recreate:
- CONFIG_NET_CLS_FLOWER=y; veth pair
- tc qdisc add dev veth0 ingress
- two concurrent `tc filter add dev veth0 ingress protocol ip pref 1
  flower skip_sw ... action drop` (both fail in fl_hw_replace_filter
  after publishing their handle in the idr); repeat in a loop
- an empty flower tp stays linked after both requests fail; visible
  as a bare `filter protocol ip pref 1 flower chain 0` header in
  `tc filter show` with no filter entries
- CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_