Executive brief
The Linux kernel's fq_codel packet scheduler has a bug in how it manages the queue length counter when dropping packets. This can cause the scheduler to incorrectly deactivate parent traffic classes, leading to memory corruption and system crashes. The vulnerability affects systems running vulnerable kernel versions and can be triggered by network traffic handling.
Technical details
The vulnerability is a use-after-free / memory corruption issue in the fq_codel qdisc module (net/sched/sch_fq_codel). When fq_codel drops packets during a peek operation, it calls qdisc_tree_reduce_backlog before restoring the qlen counter. If the queue length drops to zero temporarily while packets remain in the queue, the parent qdisc's qlen_notify callback is erroneously triggered, causing the parent class to be deactivated. This leads to wild memory access and crashes in dependent qdiscs like qfq. The fix involves deferring the qdisc_tree_reduce_backlog call until after qlen is restored. No authentication is required; any user capable of sending network traffic can trigger this condition.
Affected products
- Linux Linux Kernel 7.1.0-rc5 and earlier versions with sch_fq_codel
Timeline
- 2026-08-28: disclosed