{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().  If a netlink socket sends RTM_GETCHAIN requests repeatedly without recv()ing the responses, tc_ctl_chain() hogs CPU and triggers Hung Task splat. [0]  As caught in the stack trace, netlink_attachskb() could confuse tc_ctl_chain() by returning -EAGAIN when the userspace netlink socket's receive buffer is full.  The replay: label exists since commit 32a4f5ecd738 (\"net: sched: introduce chain object to uapi\") but was not used initially.  Since commit 9f407f1768d3 (\"net: sched: introduce chain templates\"), the label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops() may release RTNL to call request_module().  However, the replay logic is unnecessary for RTM_GETCHAIN.  Let's apply the replay logic only for RTM_NEWCHAIN.  [0]: INFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022. task:repro           state:R  running task     stack:14096 pid:1022  tgid:1014  ppid:961    task_flags:0x400040 flags:0x00080000 Call Trace:  \u003cTASK\u003e  ? clockevents_program_event (kernel/time/clockevents.c:372)  ? pskb_expand_head (net/core/skbuff.c:615)  ? skb_release_data (net/core/skbuff.c:1122)  ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232)  ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499)  ? tc_chain_notify (net/sched/cls_api.c:3045)  ? tc_chain_notify (./include/linux/skbuff.h:1384 net/sched/cls_api.c:3041)  ? netlink_unicast (net/netlink/af_netlink.c:1335)  ? rtnl_unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985)  ? tc_ctl_chain (net/sched/cls_api.c:3242)  ? rtnetlink_rcv_msg (net/core/rtnetlink.c:7146)  ? netlink_unicast (net/netlink/af_netlink.c:1354)  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:7177)  ? netlink_rcv_skb (net/netlink/af_netlink.c:2556)  ? netlink_unicast (net/netlink/af_netlink.c:1319)  ? netlink_sendmsg (net/netlink/af_netlink.c:1900)  ? __sock_sendmsg (net/socket.c:800)  ? __sys_sendto (net/socket.c:2281)  ? __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)  ? do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)  ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)  \u003c/TASK\u003e",
  "id": "DEBIAN-CVE-2026-97958",
  "modified": "2026-09-26T04:47:30.050232218Z",
  "published": "2026-09-25T11:17:23.477Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-97958"
    }
  ],
  "upstream": [
    "CVE-2026-97958"
  ]
}