CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class()
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schqfq: do not free existing class in qfqchangeclass()
Fixes qfqchangeclass() error case.
cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22999?
CVE-2026-22999 is classified as a medium severity vulnerability due to potential risks in the Linux kernel's scheduling mechanism.
How do I fix CVE-2026-22999?
Fix CVE-2026-22999 by updating to the latest version of the Linux kernel where this vulnerability has been resolved.
What are the consequences of not addressing CVE-2026-22999?
Failing to address CVE-2026-22999 may lead to unexpected behavior or instability in the system's scheduling functionality.
Which versions of the Linux kernel are affected by CVE-2026-22999?
CVE-2026-22999 affects multiple versions of the Linux kernel that implement the sch_qfq scheduling class.
Is CVE-2026-22999 exploitable remotely?
CVE-2026-22999 is not known to be exploitable remotely as it relates to local scheduling operations within the Linux kernel.