CVE-2026-22976

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset

`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class

itself is active.

Two qfq_class objects may point to the same leaf_qdisc. This happens

when:

1. one QFQ qdisc is attached to the dev as the root qdisc, and

2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()

/ qdisc_put()) and is pending to be destroyed, as in function

tc_new_tfilter.

When packets are enqueued through the root QFQ qdisc, the shared

leaf_qdisc->q.qlen increases. At the same time, the second QFQ

qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters

qfq_reset() with its own q->q.qlen == 0, but its class's leaf

qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate

an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:

[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References