CVE-2026-22999

Vulnerability

CVE-2026-22999 is a use-after-free vulnerability in the Quick Fair Queueing (QFQ) packet scheduler within the Linux kernel's network subsystem. The bug resides in the qfq_change_class() function, which, upon encountering an error, incorrectly frees the existing class structure (cl) and its associated qdisc even when the class was not newly allocated [1][2][3]. This results in dangling pointers that can be subsequently dereferenced, leading to a use-after-free condition.

Exploitation

An attacker needs local access and the CAP_NET_ADMIN capability to modify traffic control settings. By crafting a class modification request that triggers an error (e.g., providing invalid parameters), the attacker can force the erroneous free of a class that is still referenced elsewhere in the kernel. No special network position is required beyond the ability to execute tc commands.

Impact

Successful exploitation can cause a kernel crash (denial of service) or, potentially, arbitrary code execution in kernel context, leading to privilege escalation. The use-after-free affects kernel memory structures, providing an attacker with control over freed memory.

Mitigation

The fix was applied in Linux kernel stable updates [1][2][3]. Users should ensure their kernel is updated to a version containing the commit. No workarounds are available; the only mitigation is to apply the patch.