Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash (kernel panic). The issue occurs when specific network traffic queuing components (qdiscs) are nested in a way that leads to an invalid memory access. This primarily impacts system availability, potentially leading to a denial-of-service condition.
Technical details
A null pointer dereference exists in the net/sched component of the Linux kernel, specifically within the sch_red (Random Early Detection) queuing discipline. When a RED qdisc has child qdiscs (such as QFQ) that use qdisc_peek_dequeued() as a callback, a race or logic error in the peek/dequeue sequence can occur. Specifically, if a parent qdisc (like TBF) attempts to retrieve a packet, the RED qdisc may incorrectly call the child's dequeue method directly instead of using qdisc_dequeue_peeked(). This results in a null pointer dereference in qfq_dequeue. The vulnerability is reachable via local network configuration and traffic generation, leading to a denial-of-service (kernel panic). Fixes involve replacing direct dequeue calls with qdisc_dequeue_peeked in sch_red.c.
Affected products
- Linux Linux Kernel 7.1.0-rc1-00033-g46f74a3f7d57-dirty
Timeline
- 2026-04-30: patched: Initial patch authored by Jamal Hadi Salim
- 2026-05-21: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/36aa34f42cb6842cf371f3a2d3e855d24fd57a50
- https://git.kernel.org/stable/c/458d5615272d3de535748342eb68ca492343048c
- https://git.kernel.org/stable/c/587dcf970a525f543d8b5855d9f37a4ca97b76ef
- https://git.kernel.org/stable/c/8d09618840b99ef00154d3e731ce9b11e096196d
- https://git.kernel.org/stable/c/ce051eede433f876d322ac3550a36a3c6fc4c231