net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdisc, and 2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter. When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg: [ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) in
CVE-2026-22976
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-22976
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "6116a83ec167d3ab1390cded854d237481f41b63",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "0809c4bc06c9c961222df29f2eccfd449304056f",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "cdb24200b043438a144df501f1ebbd926bb1a2c7",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "43497313d0da3e12b5cfcd97aa17bf48ee663f95",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "51ffd447bc37bf1a5776b85523f51d2bc69977f6",
"versionType": "git"
},
{
"status": "affected",
"version": "0545a3037773512d3448557ba048cebb73b3e4af",
"lessThan": "c1d73b1480235731e35c81df70b08f4714a7d095",
"versionType": "git"
}
],
"programFiles": [
"net/sched/sch_qfq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.161",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.121",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.66",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.6",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/sch_qfq.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-22976
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #39716 · Revision 1
- Added to Heist Feed
- Publisher date