Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-74267

net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a wild memory access when qfq has codel as a child: [ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full) [ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 36.341357][ T370] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216 [ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000 [ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000 [ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024 [ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000 [ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578 [ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000 [ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0 [ 36.344359][ T370] PKRU: 55555554 [ 36.344481][ T370] Call Trace: ... [ 36.345054][ T370] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 36.345222][ T370] qdisc_reset (net/sched/sch_generic.c:1057) [ 36.345503][ T370] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 36.345677][ T370] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 36.346335][ T370] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556) Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • cc71a757da78dd4aa1b4a9b19cb011833730ccf2 to < bb9cfd874ee884117b33e92a002b9a45b48202f4affected
  • eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450 to < 7a05af7f58566682b73578b72ca8e53a268c43bdaffected
  • 829c49b6b2ff45b043739168fd1245e4e1a91a30 to < eba49fd85995a3851c597fa2d214f8d21736e1d8affected
  • 2f9761a94bae33d26e6a81b31b36e7d776d93dc1 to < e8c6dbadf139cb14ea6ed14add6ed6e88504deddaffected
  • 4d55144b12e742404bb3f8fee6038bafbf45619d to < e4615aa6bb7802944ae790cb4b3ef8c1b7491af3affected
  • 342debc12183b51773b3345ba267e9263bdfaaef to < 755108bb7a5083e911294c416cfea605dc75632faffected
  • 342debc12183b51773b3345ba267e9263bdfaaef to < 91e0a793a72374c20ab31a40ccec21373e82e973affected
  • 342debc12183b51773b3345ba267e9263bdfaaef to < 52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3affected
  • 7a742a9506849d1c1aa71e36c89855ceddc7d58eaffected
  • e73c838c80dccb9e4f19becc11d9f3cb4a27d483affected
  • a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31affected
  • 5.10.241 to < 5.10.261affected
  • 5.15.190 to < 5.15.212affected
  • 6.1.135 to < 6.1.178affected
  • 6.6.88 to < 6.6.145affected
  • 6.12.24 to < 6.12.97affected
  • 5.4.297 to < 5.5affected
  • 6.13.12 to < 6.14affected
  • 6.14.3 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References