GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-22976 (GCVE-0-2026-22976)

Vulnerability from cvelistv5 – Published: 2026-01-21 06:57 – Updated: 2026-06-11 18:44
VLAI
Title
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdisc, and 2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter. When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg: [ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0 Code starting with the faulting instruction =========================================== 0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.910247] PKRU: 55555554 [ 0.910391] Call Trace: [ 0.910527] <TASK> [ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485) [ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036) [ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076) [ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447) [ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861) [ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 0.912296] ? __alloc_skb (net/core/skbuff.c:706) [ 0.912484] netlink_sendmsg (net/netlink/af ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:42 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < 6116a83ec167d3ab1390cded854d237481f41b63 (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < 0809c4bc06c9c961222df29f2eccfd449304056f (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < cdb24200b043438a144df501f1ebbd926bb1a2c7 (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < 11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < 43497313d0da3e12b5cfcd97aa17bf48ee663f95 (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < 51ffd447bc37bf1a5776b85523f51d2bc69977f6 (git)
Affected: 0545a3037773512d3448557ba048cebb73b3e4af , < c1d73b1480235731e35c81df70b08f4714a7d095 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.0
Unaffected: 0 , < 3.0 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.161 , ≤ 6.1.* (semver)
Unaffected: 6.6.121 , ≤ 6.6.* (semver)
Unaffected: 6.12.66 , ≤ 6.12.* (semver)
Unaffected: 6.18.6 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V4.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:46.449Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:23.375903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:22.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_qfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6116a83ec167d3ab1390cded854d237481f41b63",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "0809c4bc06c9c961222df29f2eccfd449304056f",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "cdb24200b043438a144df501f1ebbd926bb1a2c7",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "43497313d0da3e12b5cfcd97aa17bf48ee663f95",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "51ffd447bc37bf1a5776b85523f51d2bc69977f6",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            },
            {
              "lessThan": "c1d73b1480235731e35c81df70b08f4714a7d095",
              "status": "affected",
              "version": "0545a3037773512d3448557ba048cebb73b3e4af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_qfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.161",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.121",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.66",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u003eleaf_qdisc-\u003eq.qlen \u003e 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u003eq.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u003eq.qlen == 0, but its class\u0027s leaf\nqdisc-\u003eq.qlen \u003e 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    0.903571] #PF: supervisor write access in kernel mode\n[    0.903860] #PF: error_code(0x0002) - not-present page\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n===========================================\n   0:\t0f 84 4d 01 00 00    \tje     0x153\n   6:\t48 89 70 18          \tmov    %rsi,0x18(%rax)\n   a:\t8b 4b 10             \tmov    0x10(%rbx),%ecx\n   d:\t48 c7 c2 ff ff ff ff \tmov    $0xffffffffffffffff,%rdx\n  14:\t48 8b 78 08          \tmov    0x8(%rax),%rdi\n  18:\t48 d3 e2             \tshl    %cl,%rdx\n  1b:\t48 21 f2             \tand    %rsi,%rdx\n  1e:\t48 2b 13             \tsub    (%rbx),%rdx\n  21:\t48 8b 30             \tmov    (%rax),%rsi\n  24:\t48 d3 ea             \tshr    %cl,%rdx\n  27:\t8b 4b 18             \tmov    0x18(%rbx),%ecx\n\t...\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[    0.910247] PKRU: 55555554\n[    0.910391] Call Trace:\n[    0.910527]  \u003cTASK\u003e\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\n[    0.912484]  netlink_sendmsg (net/netlink/af\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:57:35.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6116a83ec167d3ab1390cded854d237481f41b63"
        },
        {
          "url": "https://git.kernel.org/stable/c/0809c4bc06c9c961222df29f2eccfd449304056f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdb24200b043438a144df501f1ebbd926bb1a2c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/43497313d0da3e12b5cfcd97aa17bf48ee663f95"
        },
        {
          "url": "https://git.kernel.org/stable/c/51ffd447bc37bf1a5776b85523f51d2bc69977f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1d73b1480235731e35c81df70b08f4714a7d095"
        }
      ],
      "title": "net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-22976",
    "datePublished": "2026-01-21T06:57:23.939Z",
    "dateReserved": "2026-01-13T15:37:45.935Z",
    "dateUpdated": "2026-06-11T18:44:22.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22976",
      "date": "2026-09-16",
      "epss": "0.00126",
      "percentile": "0.02621"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T15:03:23.000Z",
      "cve": "CVE-2026-22976",
      "id": "msrc_CVE-2026-22976",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-22976.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-22976\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-21T07:16:01.433\",\"lastModified\":\"2026-06-17T10:20:37.777\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\\n\\n`qfq_class-\u003eleaf_qdisc-\u003eq.qlen \u003e 0` does not imply that the class\\nitself is active.\\n\\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\\nwhen:\\n\\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\\n\\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\\n/ qdisc_put()) and is pending to be destroyed, as in function\\ntc_new_tfilter.\\n\\nWhen packets are enqueued through the root QFQ qdisc, the shared\\nleaf_qdisc-\u003eq.qlen increases. At the same time, the second QFQ\\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\\nqfq_reset() with its own q-\u003eq.qlen == 0, but its class\u0027s leaf\\nqdisc-\u003eq.qlen \u003e 0. Therefore, the qfq_reset would wrongly deactivate\\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\\n\\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\\n[    0.903571] #PF: supervisor write access in kernel mode\\n[    0.903860] #PF: error_code(0x0002) - not-present page\\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\\n\\nCode starting with the faulting instruction\\n===========================================\\n   0:\\t0f 84 4d 01 00 00    \\tje     0x153\\n   6:\\t48 89 70 18          \\tmov    %rsi,0x18(%rax)\\n   a:\\t8b 4b 10             \\tmov    0x10(%rbx),%ecx\\n   d:\\t48 c7 c2 ff ff ff ff \\tmov    $0xffffffffffffffff,%rdx\\n  14:\\t48 8b 78 08          \\tmov    0x8(%rax),%rdi\\n  18:\\t48 d3 e2             \\tshl    %cl,%rdx\\n  1b:\\t48 21 f2             \\tand    %rsi,%rdx\\n  1e:\\t48 2b 13             \\tsub    (%rbx),%rdx\\n  21:\\t48 8b 30             \\tmov    (%rax),%rsi\\n  24:\\t48 d3 ea             \\tshr    %cl,%rdx\\n  27:\\t8b 4b 18             \\tmov    0x18(%rbx),%ecx\\n\\t...\\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\\n[    0.910247] PKRU: 55555554\\n[    0.910391] Call Trace:\\n[    0.910527]  \u003cTASK\u003e\\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\\n[    0.912484]  netlink_sendmsg (net/netlink/af\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/sched: sch_qfq: Correcci\u00f3n de desreferencia NULL al desactivar un agregado inactivo en qfq_reset\\n\\n\u0027qfq_class-\u0026gt;leaf_qdisc-\u0026gt;q.qlen \u0026gt; 0\u0027 no implica que la propia clase est\u00e9 activa.\\n\\nDos objetos qfq_class pueden apuntar al mismo leaf_qdisc. Esto ocurre cuando:\\n\\n1. un qdisc QFQ est\u00e1 adjunto al dev como el qdisc ra\u00edz, y\\n\\n2. otro qdisc QFQ es referenciado temporalmente (p. ej., a trav\u00e9s de qdisc_get() / qdisc_put()) y est\u00e1 pendiente de ser destruido, como en la funci\u00f3n tc_new_tfilter.\\n\\nCuando los paquetes son encolados a trav\u00e9s del qdisc QFQ ra\u00edz, el leaf_qdisc-\u0026gt;q.qlen compartido aumenta. Al mismo tiempo, el segundo qdisc QFQ dispara qdisc_put y qdisc_destroy: el qdisc entra en qfq_reset() con su propio q-\u0026gt;q.qlen == 0, pero el leaf qdisc de su clase-\u0026gt;q.qlen \u0026gt; 0. Por lo tanto, el qfq_reset desactivar\u00eda err\u00f3neamente un agregado inactivo y disparar\u00eda una desreferencia nula en qfq_deactivate_agg:\\n\\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\\n[    0.903571] #PF: supervisor write access in kernel mode\\n[    0.903860] #PF: error_code(0x0002) - not-present page\\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\\n\\nC\u00f3digo que comienza con la instrucci\u00f3n que causa el fallo\\n===========================================\\n   0:\\t0f 84 4d 01 00 00    \\tje     0x153\\n   6:\\t48 89 70 18          \\tmov    %rsi,0x18(%rax)\\n   a:\\t8b 4b 10             \\tmov    0x10(%rbx),%ecx\\n   d:\\t48 c7 c2 ff ff ff ff \\tmov    $0xffffffffffffffff,%rdx\\n  14:\\t48 8b 78 08          \\tmov    0x8(%rax),%rdi\\n  18:\\t48 d3 e2             \\tshl    %cl,%rdx\\n  1b:\\t48 21 f2             \\tand    %rsi,%rdx\\n  1e:\\t48 2b 13             \\tsub    (%rbx),%rdx\\n  21:\\t48 8b 30             \\tmov    (%rax),%rsi\\n  24:\\t48 d3 ea             \\tshr    %cl,%rdx\\n  27:\\t8b 4b 18             \\tmov    0x18(%rbx),%ecx\\n\\t...\\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\\n[    0.910247] PKRU: 55555554\\n[    0.910391] Call Trace:\\n[    0.910527]  \\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\\n[    0.912484]  netlink_sendmsg (net/netlink/af\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_qfq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"6116a83ec167d3ab1390cded854d237481f41b63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"0809c4bc06c9c961222df29f2eccfd449304056f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"cdb24200b043438a144df501f1ebbd926bb1a2c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"43497313d0da3e12b5cfcd97aa17bf48ee663f95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"51ffd447bc37bf1a5776b85523f51d2bc69977f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0545a3037773512d3448557ba048cebb73b3e4af\",\"lessThan\":\"c1d73b1480235731e35c81df70b08f4714a7d095\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_qfq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.161\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.121\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.66\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.6\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:42:23.375903Z\",\"id\":\"CVE-2026-22976\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"5.10.248\",\"matchCriteriaId\":\"F7FB331B-C639-484C-AC8F-06ACD071EE13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"82159CAA-B6BA-43C6-85D8-65BDBC175A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.161\",\"matchCriteriaId\":\"E135B7E2-61FC-4DC1-8570-ABD67894FFDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.121\",\"matchCriteriaId\":\"BB7A164B-7422-4A1C-82FB-5FCAEE53C06C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.66\",\"matchCriteriaId\":\"F72B884C-B44F-40E4-9895-CE421AC663D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.6\",\"matchCriteriaId\":\"879529BC-5B4C-4EBE-BF1D-1A31404A8B2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0809c4bc06c9c961222df29f2eccfd449304056f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43497313d0da3e12b5cfcd97aa17bf48ee663f95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51ffd447bc37bf1a5776b85523f51d2bc69977f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6116a83ec167d3ab1390cded854d237481f41b63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1d73b1480235731e35c81df70b08f4714a7d095\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdb24200b043438a144df501f1ebbd926bb1a2c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:17:51+00:00",
      "cve": "CVE-2026-22976",
      "id": "CVE-2026-22976",
      "initial_release_date": "2026-01-21T06:57:23.939000+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in sch_qfq due to NULL pointer dereference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22976.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-24T02:41:43Z",
      "cve": "CVE-2026-22976",
      "id": "CVE-2026-22976",
      "initial_release_date": "2026-01-22T00:25:00Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "567",
      "product_status:recommended": "344",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-22976",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-22976.json",
      "version": "28"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-06-02T13:00:46.449Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-22976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:42:23.375903Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:39:21.631Z\"}}], \"cna\": {\"title\": \"net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"6116a83ec167d3ab1390cded854d237481f41b63\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"0809c4bc06c9c961222df29f2eccfd449304056f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"cdb24200b043438a144df501f1ebbd926bb1a2c7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"43497313d0da3e12b5cfcd97aa17bf48ee663f95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"51ffd447bc37bf1a5776b85523f51d2bc69977f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0545a3037773512d3448557ba048cebb73b3e4af\", \"lessThan\": \"c1d73b1480235731e35c81df70b08f4714a7d095\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sched/sch_qfq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sched/sch_qfq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6116a83ec167d3ab1390cded854d237481f41b63\"}, {\"url\": \"https://git.kernel.org/stable/c/0809c4bc06c9c961222df29f2eccfd449304056f\"}, {\"url\": \"https://git.kernel.org/stable/c/cdb24200b043438a144df501f1ebbd926bb1a2c7\"}, {\"url\": \"https://git.kernel.org/stable/c/11bf9134613f6c71fc0ff36c5d8d33856f6ae3bb\"}, {\"url\": \"https://git.kernel.org/stable/c/43497313d0da3e12b5cfcd97aa17bf48ee663f95\"}, {\"url\": \"https://git.kernel.org/stable/c/51ffd447bc37bf1a5776b85523f51d2bc69977f6\"}, {\"url\": \"https://git.kernel.org/stable/c/c1d73b1480235731e35c81df70b08f4714a7d095\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\\n\\n`qfq_class-\u003eleaf_qdisc-\u003eq.qlen \u003e 0` does not imply that the class\\nitself is active.\\n\\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\\nwhen:\\n\\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\\n\\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\\n/ qdisc_put()) and is pending to be destroyed, as in function\\ntc_new_tfilter.\\n\\nWhen packets are enqueued through the root QFQ qdisc, the shared\\nleaf_qdisc-\u003eq.qlen increases. At the same time, the second QFQ\\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\\nqfq_reset() with its own q-\u003eq.qlen == 0, but its class\u0027s leaf\\nqdisc-\u003eq.qlen \u003e 0. Therefore, the qfq_reset would wrongly deactivate\\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\\n\\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\\n[    0.903571] #PF: supervisor write access in kernel mode\\n[    0.903860] #PF: error_code(0x0002) - not-present page\\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\\n\\nCode starting with the faulting instruction\\n===========================================\\n   0:\\t0f 84 4d 01 00 00    \\tje     0x153\\n   6:\\t48 89 70 18          \\tmov    %rsi,0x18(%rax)\\n   a:\\t8b 4b 10             \\tmov    0x10(%rbx),%ecx\\n   d:\\t48 c7 c2 ff ff ff ff \\tmov    $0xffffffffffffffff,%rdx\\n  14:\\t48 8b 78 08          \\tmov    0x8(%rax),%rdi\\n  18:\\t48 d3 e2             \\tshl    %cl,%rdx\\n  1b:\\t48 21 f2             \\tand    %rsi,%rdx\\n  1e:\\t48 2b 13             \\tsub    (%rbx),%rdx\\n  21:\\t48 8b 30             \\tmov    (%rax),%rsi\\n  24:\\t48 d3 ea             \\tshr    %cl,%rdx\\n  27:\\t8b 4b 18             \\tmov    0x18(%rbx),%ecx\\n\\t...\\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\\n[    0.910247] PKRU: 55555554\\n[    0.910391] Call Trace:\\n[    0.910527]  \u003cTASK\u003e\\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\\n[    0.912484]  netlink_sendmsg (net/netlink/af\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.161\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.121\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.66\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.6\", \"versionStartIncluding\": \"3.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:57:35.535Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-22976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:22.605Z\", \"dateReserved\": \"2026-01-13T15:37:45.935Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-21T06:57:23.939Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.