{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-90099", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.786Z", "datePublished": "2026-09-17T16:06:10.858Z", "dateUpdated": "2026-10-21T12:49:50.191Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:49:50.191Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: account classifier filter allocations to memcg\n\nAllocations in the tc classifier *_change() paths (filter objects,\nper-CPU counters, and per-filter aux data) use plain GFP_KERNEL without\n__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside\nmemcg charging. The shared tcf_exts_init_ex() action array allocation in\ncls_api.c was also uncharged; this patch closes it along with the\nper-classifier filter-object/percpu/aux allocations that remain\nunaccounted.\n\nAdd GFP_KERNEL_ACCOUNT to:\n- the shared tcf_exts_init_ex() action array (cls_api.c), common to every\n filter of every classifier (32 pointers, 256 bytes);\n- the filter-object, per-CPU-counter, and per-filter aux allocations in\n cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,\n cls_matchall, cls_route and cls_u32;\n- the u32_init_knode() replace-path knode allocation (cls_u32.c), which\n allocates the same struct tc_u_knode + sel.keys on every replace of an\n existing knode and was missed by the create-path-only conversion.\n\nAlso fix the cls_basic error path: basic_change() inserts fnew into the\nIDR before allocating the per-CPU counter. If alloc_percpu() fails the\nerrout path kfree'd fnew without idr_remove, leaving a dangling pointer\nin the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable\non demand (memcg at memory.max), making the dead path attacker-reachable\nand burning the handle permanently. Add the idr_remove on the percpu\nfailure path, matching the basic_set_parms failure-path pattern.\n\nNote: vega@nebusec.ai provided a poc for basic_cls, but it was easy to\nextend to the other classifiers.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),\n CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.\n- Unprivileged user in a fresh user+network namespace (unshare -Urn),\n or root with CAP_NET_ADMIN.\n- Create a large number of tc filters (e.g. tc filter add dev lo\n ingress ... ...) while watching a memcg-limited cgroup:\n system slab grows far faster than memory.current, pinning kernel\n memory outside memcg charging." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/cls_api.c", "net/sched/cls_basic.c", "net/sched/cls_bpf.c", "net/sched/cls_cgroup.c", "net/sched/cls_flow.c", "net/sched/cls_flower.c", "net/sched/cls_fw.c", "net/sched/cls_matchall.c", "net/sched/cls_route.c", "net/sched/cls_u32.c" ], "versions": [ { "version": "0da974f4f303a6842516b764507e3c0a03f41e5a", "lessThan": "5fbb06d4f3d4c509ffe95572384a498bf319e5bf", "status": "affected", "versionType": "git" }, { "version": "0da974f4f303a6842516b764507e3c0a03f41e5a", "lessThan": "bf6006cea193cf065f7a64fc7974247f8112af33", "status": "affected", "versionType": "git" }, { "version": "0da974f4f303a6842516b764507e3c0a03f41e5a", "lessThan": "68fb30607169c92de57c5c82b6af8a733af1cc09", "status": "affected", "versionType": "git" }, { "version": "0da974f4f303a6842516b764507e3c0a03f41e5a", "lessThan": "18c68c8f3d3ff0a4def1391021b439c4333a6c71", "status": "affected", "versionType": "git" }, { "version": "0da974f4f303a6842516b764507e3c0a03f41e5a", "lessThan": "1beb81947eb486716af80db7a584f9e9fef7e003", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/cls_api.c", "net/sched/cls_basic.c", "net/sched/cls_bpf.c", "net/sched/cls_cgroup.c", "net/sched/cls_flow.c", "net/sched/cls_flower.c", "net/sched/cls_fw.c", "net/sched/cls_matchall.c", "net/sched/cls_route.c", "net/sched/cls_u32.c" ], "versions": [ { "version": "2.6.18", "status": "affected" }, { "version": "0", "lessThan": "2.6.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18", "versionEndExcluding": "6.12.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18", "versionEndExcluding": "7.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5fbb06d4f3d4c509ffe95572384a498bf319e5bf" }, { "url": "https://git.kernel.org/stable/c/bf6006cea193cf065f7a64fc7974247f8112af33" }, { "url": "https://git.kernel.org/stable/c/68fb30607169c92de57c5c82b6af8a733af1cc09" }, { "url": "https://git.kernel.org/stable/c/18c68c8f3d3ff0a4def1391021b439c4333a6c71" }, { "url": "https://git.kernel.org/stable/c/1beb81947eb486716af80db7a584f9e9fef7e003" } ], "title": "net/sched: account classifier filter allocations to memcg", "x_generator": { "engine": "bippy-1.2.0" } } } }