CVE-2026-98380 Linux 内核 net/sched 空指针解引用漏洞
影响攻击者可触发内核空指针解引用，导致系统崩溃（拒绝服务）
Linux 内核 net/sched 子系统的 tcf_action_delete() 在删除 tc action 时存在竞态条件。未加锁的 classifier 可在查找与删除之间移除该 action，并以 ERR_PTR(-EBUSY) 占用同一 IDR 槽位。tcf_idr_delete_index() 仅检查 NULL，未识别错误指针，导致将其当作 tc_action 解引用。
影响范围
受影响范围为存在该缺陷代码的 Linux 内核版本，具体版本范围暂无公开信息，建议以官方补丁说明为准。
漏洞详情
漏洞类型为竞态条件导致的空指针/错误指针解引用。tcf_action_delete() 先释放查找持有的引用，再调用 tcf_idr_delete_index() 使用保存的索引；期间另一未加锁的 classifier 可删除该 action 并以 ERR_PTR(-EBUSY) 重新占用同一 IDR 槽位。tcf_idr_delete_index() 只判断结果是否为 NULL，未检查 IS_ERR，于是把错误指针当作 tc_action 访问 tcfa_bindcnt，触发 KASAN 报告的 null-ptr-deref 与 general protection fault。
利用条件与风险
利用前提是攻击者能触发并发删除同一 tc action 的竞态窗口，通常需要本地权限或对网络配置的控制。成功利用可造成内核崩溃，形成拒绝服务。
修复建议
官方已通过补丁修复，在 tcf_idr_delete_index() 中增加对 IDR 错误指针（IS_ERR）的检查并拒绝处理。建议升级到包含该修复的内核版本；临时缓解措施暂无公开信息。
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions
tcf_action_delete() drops the reference held by its lookup before calling
tcf_idr_delete_index() with the saved action index. An unlocked
classifier can remove that action and reserve the same IDR slot with
ERR_PTR(-EBUSY) in between.
tcf_idr_delete_index() only checks the lookup result for NULL. It
therefore treats the reservation as a tc_action and dereferences
tcfa_bindcnt. A hardware execution breakpoint was used to schedule the
interleaving without changing the kernel source. KASAN reported this
decoded trace:
BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
Read of size 4 at addr 0000000000000010 by task poc/150
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
RIP: tca_action_gd+0x5c0/0x1010:
arch_atomic_read at arch/x86/include/asm/atomic.h:23
raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
atomic_read at include/linux/atomic/atomic-instrumented.h:33
tcf_idr_delete_index at net/sched/act_api.c:766
tcf_action_delete at net/sched/act_api.c:1859
tcf_del_notify at net/sched/act_api.c:2014
tca_action_gd at net/sched/act_api.c:2064
R13: 0000000000000010 R15: fffffffffffffff0
Kernel panic – not syncing: Fatal exception
R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
the address in R13. With the guard applied, the same reproducer returned
-ENOENT without a KASAN report or panic. Treat error pointers as absent
and return -ENOENT.