CVE-2026-97958

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

If a netlink socket sends RTM_GETCHAIN requests repeatedly

without recv()ing the responses, tc_ctl_chain() hogs CPU and

triggers Hung Task splat. [0]

As caught in the stack trace, netlink_attachskb() could confuse

tc_ctl_chain() by returning -EAGAIN when the userspace netlink

socket's receive buffer is full.

The replay: label exists since commit 32a4f5ecd738 ("net: sched:

introduce chain object to uapi") but was not used initially.

Since commit 9f407f1768d3 ("net: sched: introduce chain templates"),

the label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()

may release RTNL to call request_module().

However, the replay logic is unnecessary for RTM_GETCHAIN.

Let's apply the replay logic only for RTM_NEWCHAIN.

[0]:

INFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.

task:repro state:R running task sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References