Junglewise Threat Intelligence

CVE-2026-45845: Linux Kernel NULL pointer dereference in TAPRIO scheduler

CVE-2026-45845 · Severity: info · CVSS 5.5 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when managing specific network traffic scheduling components (TAPRIO), where deleting certain configurations leads to a system memory error. This can result in a kernel panic, causing a complete service outage for the affected machine.

Technical details

A NULL pointer dereference exists in net/sched/sch_taprio.c within the taprio_dump_class() function. When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft() incorrectly stores a NULL pointer in the qdiscs array. Subsequent RTM_GETTCLASS operations attempt to dereference this NULL pointer while walking the classes. This is reachable by an unprivileged local user if unprivileged user namespaces are enabled, allowing them to create a new network namespace and trigger the panic. The fix involves substituting NULL with &noop_qdisc during the graft operation to ensure the array slots are never NULL.

Affected products

  • Linux Linux Kernel CONFIG_NET_SCH_TAPRIO enabled

Timeline

  • 2026-04-27: patched: Mainline kernel patch committed
  • 2026-05-27: advisory: CVE-2026-45845 published

References