CVE-2026-74284

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_hfsc: Don't make class passive twice

update_vf() is called from two places for the same class during a single

dequeue when the class's child qdisc (e.g. codel/fq_codel) drops its last

packets while dequeuing:

1. The child calls qdisc_tree_reduce_backlog(), which, now that the child

is empty, invokes hfsc_qlen_notify() -> update_vf(cl, 0, 0) and turns

the class passive (cl_nactive is decremented up the hierarchy).

2. hfsc_dequeue() then calls update_vf(cl, qdisc_pkt_len(skb), cur_time)

to charge the dequeued bytes.

On the second call the class is already passive, but its child qdisc is

still empty, so update_vf() arms go_passive again:

if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC)

go_passive = 1;

The leaf is then skipped by the cl_nactive == 0 check inside the loop,

which does not clear go_passive, so the stale go_passive propagates to the

parent and decrements

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References