CVE-2026-74267 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Whenever codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a wild memory access when qfq has codel as a child:
[ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full)
[ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 36.341357][ T370] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216
[ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000
[ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000
[ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024
[ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000
[ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578
[ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000
[ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0
[ 36.344359][ T370] PKRU: 55555554
[ 36.344481][ T370] Call Trace:
... [ 36.345054][ T370] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 36.345222][ T370] qdisc_reset (net/sched/sch_generic.c:1057)
[ 36.345503][ T370] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 36.345677][ T370] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 36.346335][ T370] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described affects the Linux kernel's traffic control subsystem, specifically within the sch_codel queuing discipline implementation. This issue manifests when codel performs packet dropping operations during peek operations, which are used to examine packets without removing them from the queue. The fundamental flaw occurs in the ordering of operations within the code where qdisc_tree_reduce_backlog is invoked before restoring the queue length, creating a temporal inconsistency that leads to incorrect state management.
The technical root cause stems from improper synchronization between packet queuing operations and backlog accounting within the kernel's networking stack. When codel drops packets during peek, it prematurely calls qdisc_tree_reduce_backlog which updates the parent queue's backlog counter. However, this occurs before the qlen is properly restored to reflect the actual queue state, creating a scenario where the parent class receives notification of an empty queue while the child codel queue still maintains one packet. This discrepancy triggers incorrect behavior in hierarchical queuing disciplines like qfq that depend on proper activation/deactivation signals.
The operational impact of this vulnerability extends beyond simple packet loss or queue management issues. The described kernel oops indicates a general protection fault resulting from what appears to be wild memory access patterns, specifically involving qfq_deactivate_agg function execution. This occurs because the parent class gets incorrectly deactivated when it still contains active packets, leading to dangling pointers and invalid memory accesses. The error trace shows the issue propagates through qfq_reset_qdisc and qdisc_graft functions, indicating a cascading failure in the queuing discipline management system.
This vulnerability aligns with CWE-129 Input Validation and CWE-367 Time-of-Check Time-of-Use errors, as it represents a temporal inconsistency in state management where operations occur in an order that violates expected sequence constraints. From an ATT&CK perspective, this maps to T1059 Command and Scripting Interpreter and T1566 Phishing through the potential for network-based exploitation that could disrupt system stability or enable privilege escalation via kernel memory corruption. The fix implemented addresses this by reordering the operations to ensure qdisc_tree_reduce_backlog is only called after qlen restoration, maintaining proper state consistency between parent and child queuing disciplines.
The resolution ensures that queue length accounting remains consistent throughout peek operations by maintaining proper ordering of state updates. This prevents the false notification of empty queues that previously caused incorrect deactivation of parent classes, thereby eliminating the memory access violations and system instability. The fix represents a classic example of temporal consistency in kernel programming where operation sequencing is critical for maintaining data integrity across complex hierarchical systems. This type of vulnerability demonstrates the importance of careful state management in kernel networking code where multiple disciplines interact through shared data structures and callback mechanisms.
Security implications extend to potential denial-of-service scenarios where network traffic could be disrupted or system stability compromised, particularly in environments using complex queuing hierarchies. The vulnerability affects not only basic packet handling but also the fundamental integrity of the kernel's traffic control subsystem, making it a critical issue for any system relying on advanced networking features and quality of service implementations.