Executive brief
A race condition in the Linux kernel's traffic control (tc) scheduler can cause an active network classifier to be silently unlinked when two simultaneous configuration requests compete to insert a protocol handler at the same network chain priority level. While the competing request wins and advertises its classifier, the losing request incorrectly tears down the active classifier, potentially disrupting traffic filtering and network policy enforcement.
Technical details
This is a race condition in the tc_new_tfilter() function within the Linux kernel's net/sched/cls_api.c module. The vulnerability occurs when two requests simultaneously attempt to insert a protocol handler at the same chain/priority level. The vulnerable code sets tp_created=1 before calling tcf_chain_tp_insert_unique(); when the insert fails due to losing the race, the loser's error path incorrectly treats the winner's proto as its own and calls tcf_chain_tp_delete_empty() on it, silently unlinking an active classifier. The fix introduces a tri-state variable (TP_NOT_CREATED, TP_CREATED, TP_NOT_OWNED) to correctly track the insert outcome and ensure each error path behaves appropriately. This is a kernel-level issue requiring root or CAP_NET_ADMIN privileges to trigger via netlink socket operations.
Affected products
- Linux Linux Kernel multiple versions (specific ranges not specified in advisory)
Timeline
- 2026-09-17: disclosed