HarborGuard / CVE
Back to search
HIGHCVE-2026-22999Published Modified CNA Linux

CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class()

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.

Metrics

CVSS v3.1
7.8
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

00a234660dc70ce45d771cbc76b20d925b73ec1602a64fb9b47afffeb5dbab5fd3a518e1436dcc90e362e269bb03f7076ba9990e518aeddb898232e503879cffd9d07aa0377c4b8835c4f64b4fb24ac785.10.2495.15.1996.1.1626.6.1226.12.676.18.76.19cff6cd703f41d8071995956142729e4bba160363e9d8f11652fa08c647bf7bba7dd8163241a332cdf06f7635499bc806cbe2bbc8805c7cef8b1edddf
Affected packages
  • Linux / Linux
    < 2a64fb9b47afffeb5dbab5fd3a518e1436dcc90e (from 462dbc9101acd38e92eda93c0726857517a24bbd) · < cff6cd703f41d8071995956142729e4bba160363 (from 462dbc9101acd38e92eda93c0726857517a24bbd) · < f06f7635499bc806cbe2bbc8805c7cef8b1edddf (from 462dbc9101acd38e92eda93c0726857517a24bbd) · < 0a234660dc70ce45d771cbc76b20d925b73ec160 (from 462dbc9101acd38e92eda93c0726857517a24bbd) · < 362e269bb03f7076ba9990e518aeddb898232e50 (from 462dbc9101acd38e92eda93c0726857517a24bbd) · < e9d8f11652fa08c647bf7bba7dd8163241a332cd (from 462dbc9101acd38e92eda93c0726857517a24bbd)
  • Linux / Linux
    3.8
    Fixed in 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, 6.19
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() | HarborGuard CVE