CRITICAL
net/sched FqCodel Peek Race
CVE-2026-80630
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq: [ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057) [ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556) Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored. [1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
02KernelScan AI Analysis
Risk summary
A race condition in the Linux kernel's net/sched subsystem, specifically in the fq_codel qdisc peek function, can lead to a wild memory access and kernel panic. The vulnerability is triggered when fq_codel drops packets during a peek operation before restoring the queue length, causing the parent's qlen_notify callback to be executed incorrectly. This can result in a general protection fault and system crash.
Vulnerability analysis
The vulnerability exists in the packet scheduler's peek operation. When packets are dropped during a peek, the code notifies the parent of the backlog reduction before restoring the internal queue length. If the queue length drops to zero but the peek still returns a packet, the parent's callback is mistakenly executed while the queue still holds that packet. This deactivates the parent's class prematurely and corrupts internal scheduler state, leading to a wild memory access when the scheduler is later reset or modified. The fix ensures the queue length is restored before notifying the parent of any drops, preventing the premature deactivation. A local attacker who can configure traffic-control queues can trigger this condition.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.190 | 5.15.212 | 20dd591d8f95 |
| 6.1 | 6.1.135 | 6.1.178 | 94a5f1efdefb |
| 6.6 | 6.6.88 | 6.6.145 | acc08a0c7f37 |
| 6.12 | 6.12.24 | 6.12.97 | 7c09843fd2b4 |
| 6.13 | 6.13.12 | 6.14 | af54df2f44d9 |
| 6.14 | 6.14.3 | 6.15 | 097f6fc7b1ae |
| 6.18 | — | 6.18.40 | — |
| 7.1 | — | 7.1.5 | — |
| mainline | — | 7.2 | — |
| 5.10 | 5.10.241 | 5.10.261 | 3e515188393e |
| 5.4 | 5.4.297 | 5.5 | 0500af8630c3 |
| cip/4.19 | — | 4.19.325-cip136 | ea5508cab761 |
| cip/4.19-rt | — | 4.19.325-cip136-rt50 | ea5508cab761 |
| cip/5.10 | — | 5.10.263-cip76 | 3e515188393e |
| cip/5.10-rt | — | 5.10.268-cip77-rt34 | 3e515188393e |
| cip/6.1 | — | 6.1.182-cip59 | 94a5f1efdefb |
| cip/6.1-rt | — | 6.1.182-cip59-rt31 | 94a5f1efdefb |
| cip/6.12 | — | 6.12.101-cip29 | 7c09843fd2b4 |