CVE-2026-45845

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: fix NULL pointer dereference in class dump

When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft()

is called with new == NULL and stores NULL into q->qdiscs[cl - 1].

Subsequent RTM_GETTCLASS dump operations walk all classes via

taprio_walk() and call taprio_dump_class(), which calls taprio_leaf()

returning the NULL pointer, then dereferences it to read child->handle,

causing a kernel NULL pointer dereference.

The bug is reachable with namespace-scoped CAP_NET_ADMIN on any kernel

with CONFIG_NET_SCH_TAPRIO enabled. On systems with unprivileged user

namespaces enabled, an unprivileged local user can trigger a kernel

panic by creating a taprio qdisc inside a new network namespace,

grafting an explicit child qdisc, deleting it, and requesting a class

dump. The RTM_GETTCLASS dump itself requires no capability.

Oops: general protection fault, probably for non-canonical address 0xdffffc00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References