CVE-2026-23105

Root

Cause

In the Linux kernel's net/sched subsystem, the Quick Fair Queueing (QFQ) scheduler used a class's child qdisc queue length (qlen) to determine whether a class should be considered active. This approach is fragile because qlen can be manipulated by an attacker controlling child qdiscs, leading to incorrect class state management. The patch replaces the qlen-based check with cl_is_active, a dedicated flag that more reliably indicates class activation.

Exploitation

Vector

An attacker with access to configure or attach child qdiscs to QFQ classes could artificially inflate or deflate the child qdisc's qlen. This manipulation would cause qfq_rm_from_ag to misclassify a class as inactive while it still has pending traffic, or vice versa. No special privileges beyond the ability to configure traffic control (tc) and attach qdiscs are required, though such operations typically need CAP_NET_ADMIN [1][2].

Impact

Successful exploitation could lead to denial of service (DoS) by preventing the QFQ scheduler from properly managing bandwidth allocation. A class that is incorrectly marked inactive may be skipped during dequeuing, delaying or dropping legitimate traffic for that class. Conversely, an incorrectly active class could consume more bandwidth than allowed, breaking QoS guarantees [3][4].

Mitigation

The fix [1] has been applied to the Linux kernel stable branches. All users are strongly advised to update to a patched kernel version. There is no workaround other than applying the kernel update, as the vulnerability is in scheduler core logic.