CVE-2026-80630: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen
Whenever fqcodel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlennotify callback will be executed even though fqcodel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq:
[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfqdeactivateagg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/schqfq.c:1369 (discriminator 2) net/sched/schqfq.c:1395 (discriminator 2)) schqfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfqresetqdisc (net/sched/schqfq.c:357 net/sched/schqfq.c:1487) schqfq [ 29.377074][ T360] qdiscreset (net/sched/schgeneric.c:1057) [ 29.377414][ T360] qdiscdestroy (net/sched/schgeneric.c:1096) [ 29.377600][ T360] qdiscgraft (net/sched/schapi.c:1062 net/sched/schapi.c:1053 net/sched/schapi.c:1159) [ 29.378593][ T360] tcgetqdisc (net/sched/schapi.c:1528 net/sched/schapi.c:1556)
Fix this by only calling qdisctreereducebacklog in peek after the qlen is restored.
[1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the net/sched fix described: in sch_fq_codel, when handling peek, avoid calling qdisc_tree_reduce_backlog before the parent's qlen is restored; ensure qlen is decremented/incremented correctly (call qdisc_tree_reduce_backlog after qlen is restored by reincrementing qlen) so that peeking cannot wrongly deactivate parent/class state due to transient qlen inconsistency.
Linux kernel traffic control (net/sched) sch_fq_codel / qdisc_tree_reduce_backlog Call flow: during peek, do not call qdisc_tree_reduce_backlog before restoring qlen = Implement logic change so qdisc_tree_reduce_backlog is called only after qlen is restored (incremented) in the peek path
Event History
Frequently Asked Questions
Which traffic-control configurations are implicated?
The issue involves fq_codel when it is used beneath a parent qdisc that has a qlen_notify callback. QFQ is specifically identified as a parent qdisc in a reported case.
What can happen when the issue is triggered?
The parent class can be incorrectly deactivated while fq_codel still contains a packet. The reported consequences include queueing problems and a wild memory access in QFQ, including a general protection fault.