CVE-2026-80630

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Whenever fq_codel drops packets during peek, it calls

qdisc_tree_reduce_backlog. An issue arises because it calls

qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops

to zero, but peek returns an skb, the parent's qlen_notify callback will be

executed even though fq_codel still has 1 packet on the queue and, thus,

will mistakenly deactivate the parent's class causing issues like a recent

report [1] and a wild memory access in qfq:

[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI

[ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]

[ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full)

[ 29.372384][

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References