CVE-2026-80630 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq:
[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full)
[ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216
[ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000
[ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000
[ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024
[ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000
[ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578
[ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000
[ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0
[ 29.376103][ T360] PKRU: 55555554
[ 29.376258][ T360] Call Trace:
[ 29.376401][ T360] <TASK>
... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057)
[ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored.
[1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability in the Linux kernel's network scheduler, specifically within the fq_codel (Fair Queuing Controlled Delay) implementation, stems from a race condition and logic error during packet inspection operations. The core issue arises when the qdisc attempts to peek at queued packets without removing them from the queue. During this process, if the internal algorithm determines that a packet should be dropped due to congestion control mechanisms like CoDel (Controlled Delay), it invokes the function qdisc_tree_reduce_backlog to update accounting metrics for parent classes and hierarchical structures. However, the original implementation executed this reduction call before restoring the queue length variable qlen after peeking operations are complete. This sequencing error creates a transient state where the reported queue length is artificially low or zero, even though packets remain logically present in the data structure because they were only inspected, not dequeued.
This incorrect accounting triggers a cascade of side effects within the traffic control subsystem. Specifically, when qlen drops to zero during this flawed sequence, but peek still returns a valid socket buffer pointer indicating an active packet, the parent qdisc's qlen_notify callback is erroneously triggered. This notification system is designed to alert upper layers or hierarchical parents about significant changes in queue depth, often used for flow control or class deactivation logic. In the context of dependent schedulers like QFQ (Weighted Fair Queuing), this false zero-length signal causes the parent to incorrectly deactivate its associated classes. The activation state management relies on accurate queue length data; providing incorrect data leads to inconsistent internal states where the scheduler believes a flow is idle or empty when it is actually active, leading to structural corruption within the qdisc tree.
The operational impact of this flaw manifests as severe stability issues and potential denial-of-service conditions for network processing paths utilizing these schedulers. As evidenced by crash reports from kernel testing environments like KASAN (Kernel Address Sanitizer), the incorrect state transitions can lead to wild memory accesses and general protection faults. The stack traces indicate that functions such as qfq_deactivate_agg attempt to manipulate list structures based on the false premise that queues are empty or in a reset state, resulting in dereferencing invalid pointers or accessing corrupted data structures. This results in kernel panics, system crashes, or unpredictable network behavior where legitimate traffic is dropped or misrouted due to the scheduler's internal logic being confused by inconsistent queue metrics. Such vulnerabilities compromise the reliability of network stack operations, particularly under load conditions that trigger frequent peek and drop decisions within fq_codel.
From a classification perspective, this vulnerability aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as it involves improper handling of shared state variables during concurrent inspection and modification logic. It also relates to CWE-829: Inclusion of Functionality from Untrusted Control Sphere if considering the broader impact on system stability through malformed internal states triggered by normal traffic patterns. The attack vector is primarily local or remote depending on whether an attacker can influence packet arrival rates to trigger the specific race condition, but it fundamentally represents a logic error in resource management rather than a traditional buffer overflow. In terms of MITRE ATT&CK, this could be categorized under T1498: Network Denial of Service, as the exploitation leads to service disruption via kernel crashes or degraded performance due to incorrect scheduling decisions.
Mitigation for this vulnerability requires applying the specific patch that corrects the order of operations within the fq_codel peek function. The fix ensures that qdisc_tree_reduce_backlog is called only after qlen has been properly restored, thereby maintaining accurate accounting throughout the inspection process and preventing false zero-length notifications to parent classes. Administrators running affected kernel versions must update their systems to a patched release where this logic error in net/sched/sch_fq_codel.c is resolved. Until patches are applied, monitoring for unusual network drops or system instability related to traffic control configurations may provide early indicators of exploitation attempts targeting these specific scheduler implementations. Regular auditing of kernel updates and adherence to vendor security advisories are critical steps in maintaining the integrity of Linux-based networking infrastructure against such logic flaws.