CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen
Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlennotify callback will be executed even though codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a wild memory access when qfq has codel as a child:
[ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full) [ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 36.341357][ T370] RIP: 0010:qfqdeactivateagg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/schqfq.c:1369 (discriminator 2) net/sched/schqfq.c:1395 (discriminator 2)) schqfq [ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216 [ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000 [ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000 [ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024 [ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000 [ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578 [ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000 [ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0 [ 36.344359][ T370] PKRU: 55555554 [ 36.344481][ T370] Call Trace: ... [ 36.345054][ T370] qfqresetqdisc (net/sched/schqfq.c:357 net/sched/schqfq.c:1487) schqfq [ 36.345222][ T370] qdiscreset (net/sched/schgeneric.c:1057) [ 36.345503][ T370] qdiscdestroy (net/sched/schgeneric.c:1096) [ 36.345677][ T370] qdiscgraft (net/sched/schapi.c:1062 net/sched/schapi.c:1053 net/sched/schapi.c:1159) [ 36.346335][ T370] tcgetqdisc (net/sched/schapi.c:1528 net/sched/schapi.c:1556)
Fix this by only calling qdisctreereducebacklog in peek after the qlen is restored.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel net/sched/sch_codel and sch_qfqto a version that resolves this vulnerability.Fixed in 7.1.0-rc5-00287-g66e13b626592 - Configuration
Apply the fix: do not call qdisc_tree_reduce_backlog during qdisc peek before restoring qlen; instead call qdisc_tree_reduce_backlog in peek only after qlen has been restored so that parent qlen/activation state (qlen_notify and class deactivation) remains consistent when codel drops during peek.
Linux kernel net/sched/sch_codel and qdisc peek logic Call qdisc_tree_reduce_backlog during peek = only call qdisc_tree_reduce_backlog in peek after restoring qlen (and qlen_notify/activation state)