CVE-2026-74267 net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

🗓️ 15 Aug 2026 05:57:42Reported by GoogleType

osv_cve🔗 osv.dev👁 28 Views

sch_codel calls qdisc_tree_reduce_backlog before restoring qlen, causing wild memory access in qfq child classes.

Source	Link
git	www.git.kernel.org/stable/c/52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3
git	www.git.kernel.org/stable/c/755108bb7a5083e911294c416cfea605dc75632f
git	www.git.kernel.org/stable/c/7a05af7f58566682b73578b72ca8e53a268c43bd
git	www.git.kernel.org/stable/c/91e0a793a72374c20ab31a40ccec21373e82e973
git	www.git.kernel.org/stable/c/bb9cfd874ee884117b33e92a002b9a45b48202f4
git	www.git.kernel.org/stable/c/e4615aa6bb7802944ae790cb4b3ef8c1b7491af3
git	www.git.kernel.org/stable/c/e8c6dbadf139cb14ea6ed14add6ed6e88504dedd
git	www.git.kernel.org/stable/c/eba49fd85995a3851c597fa2d214f8d21736e1d8
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74267.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-74267

15 Oct 2026 10:41Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8