Executive brief
The Linux kernel's traffic control (tc) classifier subsystem failed to properly charge memory allocations to cgroups, allowing unprivileged users to exhaust kernel memory and bypass resource limits. This could lead to denial of service by pinning kernel memory outside normal memory accounting constraints, degrading system performance or causing system crashes.
Technical details
The vulnerability is a memory accounting bypass (CWE-770) in the Linux kernel's net/sched subsystem. The tc classifier *_change() functions and shared tcf_exts_init_ex() allocate filter objects, per-CPU counters, and auxiliary data using plain GFP_KERNEL without the __GFP_ACCOUNT flag, allowing these allocations to escape memcg charging. Additionally, cls_basic has an error-path bug where filter objects are inserted into an IDR before per-CPU counter allocation; if allocation fails (now possible with GFP_KERNEL_ACCOUNT memcg limits), the filter object is not removed from the IDR, leaving a dangling pointer. An unprivileged user in a user+network namespace or root with CAP_NET_ADMIN can create numerous tc filters to pin large amounts of kernel memory outside memcg limits. The fix adds GFP_KERNEL_ACCOUNT to all affected allocations and corrects the cls_basic error path with proper idr_remove() on percpu allocation failure.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-17: disclosed