Linux Kernel QFQ Plus Scheduler Vulnerability Allows Local Privilege Escalation

A critical use-after-free vulnerability has been identified within the Linux Kernel's QFQ Plus scheduler, enabling local privilege escalation. The vulnerability, assigned CVE-2026-22999 by Zero Day Initiative, carries a CVSS score of 7.8, indicating a high severity.

Attackers who have already achieved low-privileged code execution on an affected system can exploit this flaw. The specific weakness lies in how the kernel handles qfq_class objects. The vulnerability arises from a failure to properly validate the existence of these objects before performing operations on them.

Successful exploitation allows an attacker to escalate their privileges to a higher level, potentially gaining administrative control over the system. Furthermore, the vulnerability can be leveraged to execute arbitrary code within the context of the kernel, granting attackers deep access and control.

The Linux kernel has since received an update to address this vulnerability. The fix is available through the official Linux kernel repository, with a specific commit identified as 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78.

The vulnerability was initially reported to the vendor on March 11, 2025. Zero Day Initiative coordinated the public release of the advisory on September 14, 2026, with an update to the advisory also published on the same date.

This vulnerability was discovered and reported by Pumpkin, a researcher from the DEVCORE Research Team. Their work highlights the ongoing need for vigilance in kernel security, as even established components can harbor critical flaws.

This discovery underscores the persistent threat of privilege escalation vulnerabilities in operating system kernels. Such flaws are highly sought after by attackers as they provide a direct path to compromising entire systems, making timely patching and robust security practices essential for all Linux users.