# net/sched: cls_flower: validate mask pointer after nla_next()

CVE record · `CVE-2026-99112`

- **Identifiers:** `CVE-2026-99112`
- **State:** Confirmed
- **Severity:** CVSS 7.1 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 28 Oct 2026
- **Updated:** 31 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 28 Oct 2026, 10:34 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `238b5ebdb6a6e4bc90810b9f8ec0063b3dfda41a to before a9283d006eef7e3b56f0f279a49bb63f6e5e61df` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before 497944d534ffb1be300365523030c7c6517cbbb6` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before a55d84907337580d91c0d54779d9d4b934633158` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before cff9bf34afde46c238189cc6f7690b7e35225df1` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before 35354bf67aa0f7bace66ffb614906124ed50d59d` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before 45e60747a9db2307929260d9aa9c1c6cbb70ee77` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before bb187146c7e5c666874784e4f3fc1bc5126e6e92` (git)
  - affected: `c96adff95619178e2118925578343ad54857c80c to before fee10655709c5c597e8e9f722f3035d9ea31ff3a` (git)
  - affected: `5.10.11 to before 5.10.273` (semver)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.11`
  - unaffected: `before 5.11` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.161 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.115 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.59 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.13 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.1 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0013, the 2nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

- 28 Oct 2026, 10:34 UTC: [Confirmed by the CVE List](https://www.cve.org/CVERecord?id=CVE-2026-99112)

## Sources

- [CVE List: CVE-2026-99112](https://www.cve.org/CVERecord?id=CVE-2026-99112)
- [NVD: CVE-2026-99112](https://nvd.nist.gov/vuln/detail/CVE-2026-99112)

### References from the CNA

- <https://git.kernel.org/stable/c/a9283d006eef7e3b56f0f279a49bb63f6e5e61df>
- <https://git.kernel.org/stable/c/497944d534ffb1be300365523030c7c6517cbbb6>
- <https://git.kernel.org/stable/c/a55d84907337580d91c0d54779d9d4b934633158>
- <https://git.kernel.org/stable/c/cff9bf34afde46c238189cc6f7690b7e35225df1>
- <https://git.kernel.org/stable/c/35354bf67aa0f7bace66ffb614906124ed50d59d>
- <https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77>
- <https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92>
- <https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-99112>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-99112/>. Everything for agents: <https://agentprime.io/llms.txt>.