{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23105", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.966Z", "datePublished": "2026-02-04T16:08:26.376Z", "dateUpdated": "2026-08-05T12:20:17.441Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:17.441Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag\n\nThis is more of a preventive patch to make the code more consistent and\nto prevent possible exploits that employ child qlen manipulations on qfq.\nuse cl_is_active instead of relying on the child qdisc's qlen to determine\nclass activation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - QFQ qdisc configuration is done via tc/netlink (RTM_NEWQDISC, RTM_NEWTCLASS) which requires local system access through netlink sockets. This is not remotely reachable.\nAC:L - The attacker fully controls the conditions needed to trigger the desync between child qdisc qlen and class active state. As demonstrated in the related commit (c1d73b1480235), an attacker can create two QFQ qdiscs sharing a child qdisc and manipulate packet flow to create the exact state inconsistency needed.\nPR:L - TC/qdisc operations require CAP_NET_ADMIN, which is checked via netlink_net_capable() against the network namespace's user_ns. An unprivileged user can obtain CAP_NET_ADMIN in a user+network namespace via unshare -Urn.\nUI:N - No user interaction is required. The attacker can set up the QFQ qdiscs, enqueue packets, and trigger the vulnerable code path entirely autonomously.\nS:U - The vulnerability affects the kernel within its own security authority. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\nC:H - The state desync can lead to a use-after-free when a class remains linked to a freed aggregate's active list (path 2: qlen manipulated to 0 while class is still active, skipping deactivation before aggregate destruction). UAF enables the attacker to control freed object contents and achieve arbitrary memory read.\nI:H - The same use-after-free condition allows heap spraying to replace the freed aggregate structure, giving the attacker arbitrary write primitives and potential control flow hijacking through corrupted function pointers or list operations.\nA:H - Both exploit paths lead to kernel crashes: path 1 causes a NULL pointer dereference in qfq_deactivate_agg/qfq_slot_remove when deactivating an already-inactive aggregate, and path 2's UAF causes crashes when accessing freed memory. The related commit (c1d73b1480235) demonstrates a concrete kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_qfq.c" ], "versions": [ { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "fac2c67bb2bb732eae4283e45fc338af7e08c254", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "b8c24cf5268fb3bfb8d16324c3dbb985f698c835", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "f27047abf7cac1b6f90c3ad60de21ef9f717c26d", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "93b8635974fb050c43d07e35e5edfe6e685ca28a", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "abd9fc26ea577561a5ef6241a1b058755ffdad0c", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "77f1afd0bb4d5da95236f6114e6d0dfcde187ff6", "status": "affected", "versionType": "git" }, { "version": "462dbc9101acd38e92eda93c0726857517a24bbd", "lessThan": "d837fbee92453fbb829f950c8e7cf76207d73f33", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_qfq.c" ], "versions": [ { "version": "3.8", "status": "affected" }, { "version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.249", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.162", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.122", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.68", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.10.249" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.199" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.162" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.122" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.12.68" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.18.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fac2c67bb2bb732eae4283e45fc338af7e08c254" }, { "url": "https://git.kernel.org/stable/c/b8c24cf5268fb3bfb8d16324c3dbb985f698c835" }, { "url": "https://git.kernel.org/stable/c/f27047abf7cac1b6f90c3ad60de21ef9f717c26d" }, { "url": "https://git.kernel.org/stable/c/93b8635974fb050c43d07e35e5edfe6e685ca28a" }, { "url": "https://git.kernel.org/stable/c/abd9fc26ea577561a5ef6241a1b058755ffdad0c" }, { "url": "https://git.kernel.org/stable/c/77f1afd0bb4d5da95236f6114e6d0dfcde187ff6" }, { "url": "https://git.kernel.org/stable/c/d837fbee92453fbb829f950c8e7cf76207d73f33" } ], "title": "net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-06-16T20:18:58.725662Z", "id": "CVE-2026-23105", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T20:19:09.986Z" } } ] } }