CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls api: Don't replay RTM GETCHAIN in tc ctl chain().

If a netlink socket sends RTM GETCHAIN requests repeatedly without recv()ing the responses, tc ctl chain() hogs CPU and triggers Hung Task splat. [0]

As caught in the stack trace, netlink attachskb() could confuse tc ctl chain() by returning -EAGAIN when the userspace netlink socket's receive buffer is full.

The replay: label exists since commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi") but was not used initially.

Since commit 9f407f1768d3 ("net: sched: introduce chain templates"), the label is needed for RTM NEWCHAIN because tcf proto lookup ops() may release RTNL to call request module().

However, the replay logic is unnecessary for RTM GETCHAIN.

Let's apply the replay logic only for RTM NEWCHAIN.

[0]: INFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022. task:repro state:R running task stack:14096 pid:1022 tgid:1014 ppid:961 task flags:0x400040 flags:0x00080000 Call Trace: ? clockevents program event (kernel/time/clockevents.c:372) ? pskb expand head (net/core/skbuff.c:615) ? skb release data (net/core/skbuff.c:1122) ? netlink attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af netlink.c:1232) ? netlink lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af netlink.c:499) ? tc chain notify (net/sched/cls api.c:3045) ? tc chain notify (./include/linux/skbuff.h:1384 net/sched/cls api.c:3041) ? netlink unicast (net/netlink/af netlink.c:1335) ? rtnl unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985) ? tc ctl chain (net/sched/cls api.c:3242) ? rtnetlink rcv msg (net/core/rtnetlink.c:7146) ? netlink unicast (net/netlink/af netlink.c:1354) ? pfx rtnetlink rcv msg (net/core/rtnetlink.c:7177) ? netlink rcv skb (net/netlink/af netlink.c:2556) ? netlink unicast (net/netlink/af netlink.c:1319) ? netlink sendmsg (net/netlink/af netlink.c:1900) ? sock sendmsg (net/socket.c:800) ? sys sendto (net/socket.c:2281) ? x64 sys sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284) ? do syscall 64 (arch/x86/entry/syscall 64.c:61 arch/x86/entry/syscall 64.c:84) ? entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)