Skip to main content

Linux Kernel EUVDEUVD-2026-67506

| CVE-2026-80630 CRITICAL
2026-08-28 Linux GHSA-x458-6j5f-w8xq
Information Disclosure Linux Canonical
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain CAP_NET_ADMIN via user namespace
  2. Delivery
    Configure fq_codel leaf under qfq parent
  3. Exploit
    Force packet drop during peek as qlen hits zero
  4. Execution
    Parent qlen_notify wrongly deactivates class
  5. Persist
    qfq dereferences poisoned list pointer
  6. Impact
    Kernel GP fault / memory corruption

Vulnerability Assessment

Exploitation Conditions

Requires local access plus CAP_NET_ADMIN to configure the qdisc tree - obtainable directly by root/network admins, or by an unprivileged local user when unprivileged user namespaces are enabled (common default on many desktop/container distros). The specific configuration needed is a classful parent qdisc (qfq is the demonstrated case) with sch_fq_codel installed as a leaf, plus a runtime state where fq_codel drops packets during a peek at the moment qlen would drop to zero while peek still returns an skb. Limiting factors: not remotely reachable despite the NVD AV:N rating, no user interaction by a victim, a non-default qdisc hierarchy must be deliberately created, and the trigger depends on a queue-state timing condition rather than a single deterministic call.
Impact

The signals conflict sharply and must be reconciled before prioritization. NVD lists CVSS 9.8 with AV:N/PR:N (remote, unauthenticated), but the description and crash trace show a purely local traffic-control (tc) operation that requires the ability to build a qfq→fq_codel qdisc hierarchy - i.e. CAP_NET_ADMIN, not a network-reachable attack. That AV:N/PR:N vector is almost certainly a mechanical over-rating; treat this as a local, privileged-configuration bug. Supporting that view, EPSS is very low (0.18%, 7th percentile), there is no KEV listing, and no POC is referenced. Realistic impact is a reliable kernel panic (DoS), with kernel memory corruption raising a plausible but unproven path to privilege escalation. Priority should be driven by exposure to untrusted local users: on hosts where unprivileged user namespaces are enabled, an ordinary user can obtain CAP_NET_ADMIN inside a namespace and reach this code, so multi-tenant, container, and CI systems warrant prompt patching; single-admin appliances face much lower practical risk.
Exploit ScenarioDerived

On a multi-tenant Linux host with unprivileged user namespaces enabled, a low-privileged user enters a new user+network namespace to gain CAP_NET_ADMIN, then uses tc to attach fq_codel as a leaf under a qfq parent and drives traffic so that a peek drops packets exactly as qlen transitions to zero. The premature backlog reduction deactivates a still-populated class, and the following qfq operation dereferences a poisoned list pointer, panicking the kernel; no public POC is currently referenced, but the report thread and KASAN trace demonstrate reliable reproduction via standard tc tooling.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Memory corruption in the Linux kernel's net/sched fq_codel queueing discipline lets a local actor with traffic-control privileges trigger a wild kernel memory access and crash. When fq_codel drops packets during a peek operation, it calls qdisc_tree_reduce_backlog before restoring qlen; if qlen momentarily hits zero while peek still holds an skb, the parent class (e.g. qfq) is wrongly deactivated, producing a general-protection fault against a poisoned list pointer (0xdead000000000100 range) as seen under KASAN. No public exploit identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV.

RemediationAI

Vendor-released patch: update to a fixed stable release for your branch - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 (or later 7.2), per the EUVD patch list - or apply the corresponding kernel.org stable commit that moves the qdisc_tree_reduce_backlog() call to after qlen is restored in fq_codel's peek path. For distro kernels, install the vendor's updated package (e.g. Canonical/Ubuntu security update) matching your series. Where immediate patching is not possible, the most effective compensating control is to remove the attack surface: disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on Debian/Ubuntu, or user.max_user_namespaces=0) so untrusted local users cannot obtain CAP_NET_ADMIN - trade-off: this can break container runtimes and sandboxing (Chrome, Flatpak, rootless Podman). Additionally, avoid configuring fq_codel as a leaf under classful parents like qfq on exposed hosts, and restrict tc/qdisc configuration to trusted administrators. These controls reduce but do not eliminate exposure for hosts where administrators legitimately manage qdiscs.

Affected VersionsENISA

Linux 5.10.241 <5.10.261
Linux 342debc12183b51773b3345ba267e9263bdfaaef <0500af8630c3253f0dde879bd3a73a06bb2f2b3f
Linux patch: 5.10.261
Linux patch: 6.12.97
Linux e73c838c80dccb9e4f19becc11d9f3cb4a27d483
Linux patch: 7.2
Linux 2f9761a94bae33d26e6a81b31b36e7d776d93dc1 <acc08a0c7f37ebb1901144e03a7cba7d4afd9203
Linux 4d55144b12e742404bb3f8fee6038bafbf45619d <7c09843fd2b44d9bf0de798683861d1aecd62a08
Linux 5.4.297 <5.5
Linux 6.12.24 <6.12.97
Linux patch: 6.18.40
Linux 6.14.3 <6.15
Linux 6.1.135 <6.1.178
Linux 342debc12183b51773b3345ba267e9263bdfaaef <af54df2f44d9605614bc7ed96640302a240a9a62
Linux patch: 7.1.5
Linux patch: 0
Linux a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31
Linux patch: 5.15.212
Linux 342debc12183b51773b3345ba267e9263bdfaaef <097f6fc7b1ae362dd7a9444b2572162fda73b284
Linux 6.13.12 <6.14
Linux patch: 6.1.178
Linux eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450 <20dd591d8f951e1e6aca5052be8785e6181055e2
Linux 6.15
Linux 5.15.190 <5.15.212
Linux 7a742a9506849d1c1aa71e36c89855ceddc7d58e
Linux patch: 6.6.145
Linux cc71a757da78dd4aa1b4a9b19cb011833730ccf2 <3e515188393e62a718ccebee651ee74514104ff6
Linux 829c49b6b2ff45b043739168fd1245e4e1a91a30 <94a5f1efdefb01f82cd228bf4e7ef1e8fc075c80
Linux 6.6.88 <6.6.145

Affected Packages

euvd linux fix: 5.5, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.14, 6.15

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in the kernel packet scheduler subsystem (net/sched), specifically sch_fq_codel operating as a leaf qdisc beneath a classful parent such as sch_qfq. Classful qdiscs track per-class queue length and use qlen_notify() to activate/deactivate a class when its backlog transitions to/from zero. The root cause is an ordering/accounting error: qdisc_tree_reduce_backlog() is invoked during peek before qlen is reincremented, so the parent observes a false empty state and deactivates a class that still holds a packet. The subsequent qfq_deactivate_agg() then walks a list entry that was already poisoned (LIST_POISON, 0xdead000000000100/0x122), causing the wild access. This is effectively a use-after-poison / improper state-accounting flaw (no CWE was supplied in the feed; closest classes are CWE-763/CWE-909-style improper resource state handling).

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local tc configuration bug needing CAP_NET_ADMIN (reachable via unprivileged userns, so PR:L) plus a queue-state timing race (AC:H); kernel memory corruption supports high C/I/A, primarily availability.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 29, 2026 - 07:22 NVD
9.8 (CRITICAL)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:48 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 28, 2026 - 06:48 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq:

[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057) [ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)

Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored.

[1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/

Executive ViewAI

Why It Matters

A critical stability vulnerability in the Linux kernel's traffic-control component affects organizations running systems with traffic shaping enabled, potentially enabling privileged local users to trigger kernel crashes and disrupt services. With a vendor patch available and low exploitation risk (0.2% EPSS), organizations should plan coordinated patching within existing maintenance windows to prevent operational disruption.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel; sch_fq_codel and net/sched present in virtually all deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80630 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/396564 REF https://git.kernel.org/stable/c/0500af8630c3253f0dde879bd3a73a06bb2f2b3f REF https://git.kernel.org/stable/c/097f6fc7b1ae362dd7a9444b2572162fda73b284 REF https://git.kernel.org/stable/c/20dd591d8f951e1e6aca5052be8785e6181055e2 REF https://git.kernel.org/stable/c/3e515188393e62a718ccebee651ee74514104ff6 REF https://git.kernel.org/stable/c/7c09843fd2b44d9bf0de798683861d1aecd62a08 REF https://git.kernel.org/stable/c/94a5f1efdefb01f82cd228bf4e7ef1e8fc075c80 REF https://git.kernel.org/stable/c/acc08a0c7f37ebb1901144e03a7cba7d4afd9203 REF https://git.kernel.org/stable/c/af54df2f44d9605614bc7ed96640302a240a9a62

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy