Linux Kernel CVE-2026-98017

Requires local access with CAP_NET_ADMIN to issue RTM_NEWQDISC netlink configuration requests (natively or inside a user namespace that grants it). The specific trigger is installing a clsact qdisc that binds a populated shared ingress block AND supplying an invalid TCA_RATE attribute in the same request, so that estimator setup fails after ->init() has already published the embedded mini_Qdisc. Exploitation is further gated by a race window: the freed qdisc must still be referenced by a concurrent tc_run() on the live packet-processing path, meaning active traffic through the interface is needed to reliably reach the use-after-free. Impact is limited to kernel denial of service (crash); no unauthenticated or remote vector exists (AV:L).

This is a use-after-free (CWE-416, though CWE is listed as N/A in input) in the Linux kernel net/sched traffic-control subsystem, disclosed via the standard kernel.org 'has been resolved' advisory. NVD assigns 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, but this appears OVERSTATED on two axes. First, AC:L understates the difficulty: the bug requires winning a race between the qdisc-creation unwind path (which synchronously frees the qdisc after an invalid TCA_RATE) and a concurrent tc_run() on the packet path still holding the freed mini_Qdisc - a timing-dependent condition better modeled as AC:H. Second, C:H/I:H is generous: the description frames this purely as a freed-object-still-in-use crash primitive with no claim of information leak or privilege escalation, so the realistic impact is availability (kernel panic/DoS), i.e. closer to C:N/I:L/A:H. My independent estimate is ~5.0. On the exploitation-likelihood side all signals are quiet and consistent: no EPSS score provided, not in CISA KEV (no confirmed active exploitation), and no public POC identified. Reconfiguring qdiscs via RTM_NEWQDISC requires CAP_NET_ADMIN (reflected as PR:L), which further limits the attacker population to those already holding network-admin capability (natively or within a user namespace). Net assessment: a legitimate local DoS bug worth patching in the normal kernel-update cadence, not an emergency - the high CVSS is driven by conservative C/I assumptions the description does not substantiate.

A local user with CAP_NET_ADMIN (including within an unprivileged user namespace where permitted) issues an RTM_NEWQDISC netlink request that installs a clsact qdisc binding a populated shared ingress block and includes a deliberately invalid TCA_RATE attribute. The init succeeds and publishes an embedded mini_Qdisc to lockless readers, but estimator setup then fails and the unwind synchronously frees the qdisc while a concurrent packet flowing through tc_run() still references it, yielding a use-after-free and kernel crash. No public exploit code has been identified at time of analysis; success depends on winning the race with live traffic.