CVE-2026-98380

Executive Summary

CVE-2026-98380 is a race condition in the Linux kernel's network scheduler action API (net/sched/act_api.c) that leads to a NULL pointer dereference and kernel panic when deleting traffic control actions. The vulnerability is introduced by an unlocked classifier that can remove an action and re-reserve the same IDR slot with an error pointer between two operations in tcf_action_delete(). Any local user with the ability to interact with traffic control (tc) actions can trigger a denial of service, and in certain configurations the primitive may be leveraged for privilege escalation.

Technical Analysis

The vulnerability resides in the Linux kernel traffic control (TC) action management subsystem, specifically in the functions tcf_action_delete(), tcf_idr_delete_index(), and tca_action_gd() within net/sched/act_api.c.

The core problem is a time-of-check/time-of-use (TOCTOU) race condition combined with improper error pointer validation. The sequence of operations is as follows:

1. tcf_action_delete() performs a lookup to obtain a reference to a tc_action structure.
2. It drops that reference before calling tcf_idr_delete_index() with a saved action index.
3. Because the lookup is unlocked, a concurrent classifier can remove the action and reserve the same IDR slot with ERR_PTR(-EBUSY) in the interval between the drop and the delete call.
4. tcf_idr_delete_index() only validates the lookup result against NULL. It does not check for IS_ERR()-style error pointers.
5. Consequently, the ERR_PTR(-EBUSY) reservation is treated as a valid tc_action pointer.
6. The function dereferences tcfa_bindcnt (at offset 0x10 from the base of the structure), producing an invalid address and a general protection fault.

The reported KASAN trace confirms the exact call chain: tca_action_gd → tcf_del_notify → tcf_action_delete → tcf_idr_delete_index → atomic_read → arch_atomic_read.

Register state at crash: R15 holds ERR_PTR(-EBUSY) (0xffffffffffffff0), and adding the tcfa_bindcnt offset yields R13 = 0x10. The read of size 4 at address 0x10 triggers a kernel panic: "Fatal exception."

A hardware execution breakpoint was used by the reporter to schedule the interleaving without modifying kernel source, demonstrating the race is practically reproducible in a controlled environment. The attack surface is local: the attacker must be able to issue tc action netlink messages, which typically requires CAP_NET_ADMIN or a user namespace that grants such capability. However, on systems where unprivileged user namespaces are enabled, the barrier to entry is significantly lowered.

Exploitation Scenarios

1. Reconnaissance/Target Identification — The attacker identifies a Linux system where unprivileged user namespaces are enabled (kernel.unprivileged_userns_clone=1) or where the attacker already has CAP_NET_ADMIN. This is common on default desktop distributions and many container environments.

2. Triggering the Flaw Class — The attacker must race two concurrent operations that manipulate a traffic control action index. One thread repeatedly deletes an action via the netlink RTM_DELACTION path, entering tcf_action_delete(). A second thread (the "unlocked classifier") removes the action and re-reserves the same IDR slot with ERR_PTR(-EBUSY). The window is small but can be widened with repeated attempts or by using hardware breakpoints as demonstrated in the report.

3. Payload/Execution Method — No specific payload is required beyond the race itself. The fault occurs when tcf_idr_delete_index() dereferences tcfa_bindcnt on the error pointer. The result is an immediate kernel oops/panic. No memory corruption, code execution, or data exfiltration is demonstrated in the provided data; the impact is strictly availability.

4. Post-Exploitation Impact — Successful triggering causes a kernel panic and system crash (denial of service). If the attacker can repeatedly induce the panic, the system becomes unusable. In the absence of demonstrated write primitives, this CVE should be treated as a local DoS with a possible secondary use in a more complex exploitation chain, but no such chain is provided by the available data.

Note: No public PoC is available; the attack chain described is inferred from the vulnerability class (race condition leading to NULL pointer dereference) and the exact call chain given in the NVD description.

Impact Assessment

• Confidentiality: None — no data disclosure is described.
• Integrity: None — no data modification is described.
• Availability: High — kernel panic and system crash.
• Attack Vector: Local (AV:L) — requires ability to send netlink tc messages, typically CAP_NET_ADMIN or user namespace access.
• Attack Complexity: High (AC:H) — race condition requires precise timing; the reporter used hardware breakpoints to schedule it reliably.
• Privileges Required: Low (PR:L) — the attacker must have a local account and the ability to interact with the TC subsystem.
• User Interaction: None (UI:N).

The blast radius is any Linux kernel build that includes CONFIG_NET_SCHED and the tc action infrastructure. This includes servers, desktops, and container hosts. Exploitation causes a complete loss of availability (kernel panic). There is no evidence of in-the-wild exploitation, and the CVE is not in CISA KEV. EPSS is not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Linux Kernel Traffic Control Action Race Condition Attempt
id: 9c3e7b1a-5f2d-4e8a-9c1b-7d6e5f4a3b2c
status: experimental
description: Detects repeated netlink RTM_DELACTION operations that may indicate exploitation of CVE-2026-98380
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'NETFILTER_CFG'
    msg|contains: 'table=filter'
  filter:
    exe: '/usr/sbin/tc'
  condition: selection and not filter
falsepositives:
  - Legitimate traffic control management by administrators
level: medium

YARA Rule

rule CVE_2026_98380_Kernel_Race
{
    meta:
        description = "Detects kernel crash strings associated with CVE-2026-98380"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98380"
    strings:
        $s1 = "tcf_idr_delete_index" ascii wide
        $s2 = "tca_action_gd" ascii wide
        $s3 = "tcf_action_delete" ascii wide
        $s4 = "KASAN: null-ptr-deref in tca_action_gd" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert netlink any any -> any any (msg:"CVE-2026-98380 Potential Traffic Control Action Race Condition"; flow:to_server; content:"|10 00 00 00|"; depth:4; offset:16; classtype:attempted-dos; sid:10000001; rev:1;)

Elastic Detection

process where process.name == "tc" and event.action == "exec" and process.args : ("action", "delete") and process.args_count > 3

Splunk SPL Query

index=linux sourcetype=auditd type=NETFILTER_CFG OR (type=SYSCALL comm="tc" exe="/usr/sbin/tc")
| stats count by host, exe, uid, auid
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="linux,cve-2026-98380,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="type">NETFILTER_CFG</field>
    <field name="msg">table=filter</field>
    <description>CVE-2026-98380: Suspicious traffic control action deletion pattern detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict access to the tc command and netlink NETLINK_ROUTE socket families to trusted processes only.
   • Disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0) where feasible to reduce the local attack surface.
   • Apply LSMs (SELinux/AppArmor) to confine which processes can issue RTM_DELACTION messages.
   • Monitor kernel logs for BUG/KASAN traces involving tcf_idr_delete_index or tca_action_gd and treat them as active exploitation attempts.

2. Patch/Upgrade Steps:

   • No upstream patch is available per tracked sources. Monitor the Linux kernel netdev mailing list and stable tree for a fix that adds an IS_ERR_OR_NULL() check in tcf_idr_delete_index() or holds the reference across the delete call.
   • When a patch is released, apply it via your distribution's kernel update channel and reboot to load the new image.

3. Long-term Hardening:

   • Implement reference counting discipline review across net/sched/act_api.c to ensure unlocked lookups cannot race with deletions.
   • Adopt kernel self-protection features (KASLR, KASAN builds for testing) and enable panic_on_oops only where availability trade-offs are acceptable.
   • Use continuous fuzzing of netlink TC interfaces with race-detection tooling (e.g., KCSAN) to catch similar TOCTOU issues.

References

• NVD – CVE-2026-98380
• Linux Kernel net/sched/act_api.c source
• Linux Kernel Netlink TC Documentation
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-98380 is not listed.
• FIRST.org EPSS — CVE-2026-98380 is not yet scored.

No known threat actor campaigns or exploit-in-the-wild evidence are available for CVE-2026-98380 at this time.