CVE-2026-98380: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98380 is a race condition vulnerability in the Linux kernel's net/sched (traffic control) subsystem that can cause a kernel panic, resulting in a denial of service. The flaw exists in tcf_action_delete() and tcf_idr_delete_index() in net/sched/act_api.c, introduced at commit 0190c1d452a9 and present from kernel version 4.19 onward. It was published on October 9, 2026, with patches available for stable branches. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.177% (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization). tcf_action_delete() drops its reference to a traffic control action and saves the IDR index before calling tcf_idr_delete_index(). In the window between these operations, an unlocked classifier can delete the action and reserve the same IDR slot with ERR_PTR(-EBUSY). Because tcf_idr_delete_index() only validates the IDR lookup result against NULL (not against error pointers), it treats the ERR_PTR value as a valid tc_action structure and dereferences tcfa_bindcnt, causing a general protection fault and kernel panic. The fix adds a check to treat error pointers as absent and return -ENOENT (GitHub Advisory).

Successful exploitation causes a kernel panic, crashing the affected system and resulting in a complete denial of service. The vulnerability requires local access with privileges sufficient to configure traffic control actions, limiting the attack surface to local users or processes with CAP_NET_ADMIN. There is no evidence of confidentiality or integrity impact; the sole consequence is system availability loss (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability was demonstrated using a hardware execution breakpoint to schedule the race condition interleaving without modifying kernel source, as confirmed by KASAN output. The EPSS score is 0.177% (7th percentile), indicating low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Gain local access: Obtain a local account or process with CAP_NET_ADMIN privileges on a vulnerable Linux system (kernel 4.19 through the unpatched versions of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, or 7.2 stable branches).
2. Set up traffic control actions: Use tc (iproute2) to create traffic control (tc) actions in the net/sched subsystem, establishing entries in the IDR table.
3. Trigger the race condition: Concurrently issue a delete operation (tcf_action_delete()) and a competing classifier operation that removes the same action and reserves the IDR slot with ERR_PTR(-EBUSY). A hardware execution breakpoint or tight timing loop can be used to reliably schedule the interleaving.
4. Cause kernel panic: The racing operation causes tcf_idr_delete_index() to dereference the error pointer as a tc_action struct, triggering a general protection fault and kernel panic, crashing the system (GitHub Advisory).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing BUG: KASAN: null-ptr-deref in tca_action_gd, Oops: general protection fault, or Kernel panic - not syncing: Fatal exception with stack traces referencing tcf_idr_delete_index, tcf_action_delete, tcf_del_notify, or tca_action_gd in net/sched/act_api.c.
• Process: Unusual processes (e.g., named poc) repeatedly invoking tc action deletion commands or netlink socket operations targeting the net/sched subsystem.
• Network: Abnormal or repeated netlink (NETLINK_ROUTE) messages related to traffic control action deletion (RTM_DELACTION) from a non-administrative user context.

Apply the kernel patches available for the affected stable branches: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5 or later. The fix modifies tcf_idr_delete_index() to check for and reject IDR error pointers (returning -ENOENT) in addition to NULL. As a workaround, restrict access to traffic control action configuration (CAP_NET_ADMIN) to trusted administrators only, reducing the local attack surface (GitHub Advisory, Feedly).

The vulnerability was announced via the Linux kernel CVE mailing list (lore.kernel.org) and picked up by standard vulnerability aggregators including VulDB, Vulners, and INCIBE-CERT. No notable independent researcher commentary or significant social media discussion has been identified beyond routine CVE tracking (Linux Kernel Announce).