CVE-2026-90099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: account classifier filter allocations to memcg

Allocations in the tc classifier *_change() paths (filter objects,

per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without

__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside

memcg charging. The shared tcf_exts_init_ex() action array allocation in

cls_api.c was also uncharged; this patch closes it along with the

per-classifier filter-object/percpu/aux allocations that remain

unaccounted.

Add GFP_KERNEL_ACCOUNT to:

- the shared tcf_exts_init_ex() action array (cls_api.c), common to every

filter of every classifier (32 pointers, 256 bytes);

- the filter-object, per-CPU-counter, and per-filter aux allocations in

cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,

cls_matchall, cls_route and cls_u32;

- the u32_init_knode() replace-path knode allocation (cls_u32.c), which

allocates the same struct tc_u_knode +

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References