CVE-2026-90099

CVE-2026-90099 affects the Linux kernel's net/sched (traffic control) subsystem. Allocations in tc classifier *_change() paths use GFP_KERNEL without __GFP_ACCOUNT , allowing unprivileged users in a user+network namespace to pin kernel memory outside memcg charging by creating large numbers of tc...