Junglewise Threat Intelligence

CVE-2026-22976: Linux Kernel NULL pointer dereference in sch_qfq traffic scheduler

CVE-2026-22976 · Severity: medium · CVSS 5.5 · Published 2026-01-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network traffic scheduling component could allow a local user to crash the system. The issue occurs when the system incorrectly handles network queues that are being shared and destroyed simultaneously. This results in a system 'kernel panic' or crash, leading to a denial of service for the affected machine.

Technical details

A NULL pointer dereference exists in the net/sched/sch_qfq.c component of the Linux kernel. The vulnerability is rooted in the qfq_reset function, which incorrectly assumes that a non-zero queue length in a shared leaf_qdisc implies the associated class is active. When two QFQ qdisc objects share a leaf_qdisc—common during certain filter operations (tc_new_tfilter)—one qdisc may attempt to deactivate an aggregate that is already inactive, leading to a NULL dereference in qfq_deactivate_agg. This can be triggered by a local attacker with sufficient privileges to manipulate network traffic control (tc) settings. Patches have been released across multiple stable kernel branches to ensure proper activation state checks.

Affected products

  • Linux Linux Kernel 5.11 to 5.15.198, 6.2 to 6.6.121, 6.7 to 6.12.66, 6.13 to 6.18.6, 6.19-rc1 to 6.19-rc4

Timeline

  • 2026-01-05: disclosed: Initial patch submission by Xiang Mei.
  • 2026-01-21: advisory: CVE-2026-22976 published.

References

Related threats