Executive brief
A vulnerability in the Linux kernel's network traffic control system could allow a local user to cause a system crash or potentially gain elevated privileges. The issue occurs when reconfiguring specific network scheduling rules (ETS qdisc), which fails to properly manage internal lists of active network traffic classes. This can lead to memory corruption or system instability during routine network management operations.
Technical details
A vulnerability exists in net/sched/sch_ets.c within the Linux kernel's traffic control subsystem. When a user modifies an ETS qdisc to change a Deficit Round Robin (DRR) class into a strict priority class, the kernel fails to check if the class is currently in the active list and remove it. If the class is later reverted to DRR, it is added to the active list a second time, causing a 'list_add double add' corruption. This can be triggered via 'tc' commands by a user with CAP_NET_ADMIN privileges. The fix involves explicitly removing the class from the active list during the transition to strict priority.
Affected products
- Linux Linux Kernel cd9b50adc6bb9 to b1e125ae425aba9b45252e933ca8df52a843ec70
Timeline
- 2025-12-08: disclosed: Initial patch submission
- 2026-01-13: advisory: CVE published
- 2026-01-19: patched: Stable kernel backports committed
References
- https://git.kernel.org/stable/c/02783a37cb1c0a2bd9fcba4ff1b81e6e209c7d87
- https://git.kernel.org/stable/c/2f125ebe47d6369e562f3cbd9b6227cff51eaf34
- https://git.kernel.org/stable/c/43d9a530c8c094d137159784e7c951c65f11ec6c
- https://git.kernel.org/stable/c/58fdce6bc005e964f1dbc3ca716f5fe0f68839a2
- https://git.kernel.org/stable/c/8067db5c95aab9461d23117679338cd8869831fa
- https://git.kernel.org/stable/c/b1e125ae425aba9b45252e933ca8df52a843ec70
- https://git.kernel.org/stable/c/cca2ed931b734fe48139bc6f020e47367346630f