Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq: [ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057) [ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556) Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored. [1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:47.850Z",
  "pubdate": "2026-08-28T08:16:47.850Z",
  "executiveSummary": "A logic vulnerability exists in the Linux kernel's fq_codel (Fair Queuing Controlled Delay) packet scheduler implementation.\nThe flaw stems from an incorrect sequence of operations during the packet peek process, specifically involving the premature invocation of the qdisc_tree_reduce_backlog function.\nWhen a packet drop occurs during a peek operation, the scheduler triggers a tree backlog reduction before the queue length (qlen) is correctly restored.\nThis inconsistent state causes the kernel to falsely report an empty queue to parent qdiscs, potentially triggering premature deactivation callbacks.\nThe primary impact is a kernel-level General Protection Fault (GPF) and a wild-memory-access leading to system instability or a kernel panic.\nThe vulnerability is exploitable through standard traffic control (tc) operations, requiring local root or administrative privileges to configure the malicious queuing discipline parameters.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper state synchronization within net/sched/sch_fq_codel.c during the peek path. The fq_codel discipline maintains internal packet queues and manages congestion via active queue management. When a peek operation is performed, the code may perform drops to manage the queue length; however, it invokes qdisc_tree_reduce_backlog while the local qlen count is temporarily inconsistent.\nThe attack flow proceeds as follows: 1) A peek operation is initiated, causing fq_codel to drop one or more packets. 2) The function calls qdisc_tree_reduce_backlog to inform the parent qdisc that the backlog has decreased. 3) Crucially, the internal qlen state is decremented and not yet restored to reflect the actual remaining packets in the queue. 4) If the decremented qlen hits zero, the parent qdisc receives a signal that the queue is empty, triggering a class deactivation callback (e.g., in qfq). 5) Because the queue still contains a pending packet that was not fully processed or discarded, the parent qdisc enters an inconsistent state, attempting to access memory structures associated with a deactivated queue.\nThis leads to a General Protection Fault, as evidenced by the provided oops log, where an invalid memory address is accessed during qfq_deactivate_agg. This indicates that the scheduler logic violates the expected invariants of the qdisc hierarchy, leading to a race-like condition where the parent hierarchy is modified while still holding references to an active queue.\nThe vulnerability is a logic flaw rather than a memory corruption bug in the traditional sense, but the impact is a crash due to the scheduler dereferencing pointers (e.g., dead000000000120) derived from an inconsistent internal state. It affects the Linux kernel networking subsystem's scheduler implementation, specifically the interface between fq_codel and its parent classes. Exploitation is limited to the local environment, as it requires the ability to configure traffic control structures via netlink, which typically requires CAP_NET_ADMIN privileges."
}