Executive brief
A vulnerability in the Linux kernel's network scheduling component could allow a local user to cause a system crash (kernel panic). This occurs when specific network traffic management configurations are used, leading to a system instability that disrupts all operations on the affected machine.
Technical details
A null pointer dereference vulnerability exists in the net/sched: sch_sfb component of the Linux kernel. The issue arises when the Stochastic Fair Blue (SFB) scheduler has child queueing disciplines (qdiscs), such as QFQ, that use qdisc_peek_dequeued() as their peek callback. When a parent qdisc attempts to retrieve a packet, a direct dequeue call is made instead of using the appropriate peek-and-dequeue logic, leading to a kernel panic. This has been resolved by replacing direct dequeue calls with qdisc_dequeue_peeked() to correctly handle the gso_skb queue.
Affected products
- Linux Linux kernel 7.1.0-rc1-00035-gac961974495b-dirty
Timeline
- 2026-07-19: advisory: CVE-2026-64012 published by NVD
References
- https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e
- https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9
- https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997
- https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0
- https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae
- https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e
- https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318