Linux Kernel CVE-2026-45845

Exploitation requires three conditions to align: (1) the kernel must be compiled with CONFIG_NET_SCH_TAPRIO enabled - this is true for most distribution kernels where sch_taprio is available as a loadable module; (2) the attacker must be able to create a TAPRIO qdisc, which requires CAP_NET_ADMIN scoped to a network namespace - on systems with unprivileged user namespaces enabled (kernel.unprivileged_userns_clone=1 or user.max_user_namespaces > 0, the default on Ubuntu 20.04+, Fedora, Debian 10+, and most container platforms) any unprivileged local user can satisfy this via unshare(CLONE_NEWNET) with no prior privileges; on hardened systems where unprivileged user namespaces are disabled, the attacker requires at least a local user account with system-level CAP_NET_ADMIN; (3) the triggering RTM_GETTCLASS dump requires no capability at all. Exploitation is strictly local - no remote attack path exists. The bug does not enable privilege escalation to root; the sole impact is a kernel panic causing full host availability loss.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is broadly accurate, but the PR:L rating understates the real-world attack surface on systems with unprivileged user namespaces enabled: creating a new network namespace requires no existing privilege on such systems, effectively making the attack equivalent to PR:N for local users on Ubuntu, Fedora, Debian, and similar. EPSS of 0.02% (5th percentile) indicates very low automated exploitation probability, and the vulnerability is absent from CISA KEV with no public exploit code identified at time of analysis. However, the attack sequence is fully described in the commit message and requires only standard netlink calls (tc commands), making independent rediscovery low-effort. SSVC signals: exploitation status is none confirmed, automatable yes (fixed sequence of netlink operations), technical impact is total availability loss (kernel panic crashes the host). The impact is purely denial-of-service - no confidentiality or integrity impact is present. Risk is highest on multi-tenant Linux hosts, container orchestration nodes, and cloud VMs where local users exist and unprivileged user namespaces are enabled by default; risk is substantially lower on hardened systems where user.max_user_namespaces=0.

An unprivileged user on a default Ubuntu or Fedora system opens a new network namespace via unshare(CLONE_NEWNET) to obtain namespace-scoped CAP_NET_ADMIN at no privilege cost, then issues a sequence of tc netlink commands: creates a TAPRIO qdisc on a virtual interface, grafts a child qdisc to it via RTM_NEWQDISC, deletes the child via RTM_DELQDISC (causing taprio_graft() to store NULL), and finally runs tc class show which triggers RTM_GETTCLASS - taprio_walk() enumerates all classes, taprio_dump_class() dereferences the NULL pointer at offset 0x38, and the kernel panics with a general protection fault, crashing the entire host. No public exploit code has been identified, but the attack sequence is fully documented in the commit message and requires only standard tc/netlink calls.