CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls api: reclaim an empty proto on the error path

Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on the shared proto and both can fail: the winner's tcf chain tp delete empty() attempt gives up because the loser's handle is still in the idr, and the loser's error path drops only its own reference without a second reclamation attempt. The empty proto stays linked in the chain, holding the chain reference, a block reference and the classifier module reference until the chain or block is torn down.

Reclaim the proto on the error path of any failed request that holds a proto reference. The reclamation is emptiness-gated: tcf chain tp delete empty() unlinks the proto only when delete empty() admits it is empty, so a live shared proto is never unlinked. A proto the request created is reclaimed unconditionally - it is the only owner, so marking it for deletion is safe even without a delete empty callback. Classifiers without one (the check marks the proto unconditionally) are rtnl-serialized, so the raced window this guard closes cannot arise for them.

This is a follow-up to commit d4e359b3608a ("net/sched: cls api: fix teardown of an adopted proto on insert-race loss"), which stopped the loser of the insert race from unlinking the winner's live proto but left the empty-proto residual in place.

Conditions to recreate: