AZL-102933 CVE-2026-90058 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

EUVD-2026-81702

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...

EUVD-2026-81960

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90099

CVE-2026-90099 affects the Linux kernel's net/sched (traffic control) subsystem. Allocations in tc classifier *_change() paths use GFP_KERNEL without __GFP_ACCOUNT , allowing unprivileged users in a user+network namespace to pin kernel memory outside memcg charging by creating large numbers of tc...

CVE-2026-90058

CVE-2026-90058 is a Linux kernel vulnerability in the net/sched subsystem. The root cause is that qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through overhead, size-table data (u16), and size_log, allowing a crafted stab to set th...

CVE-2026-46331

PACKETEDITMEME - CVE-2026-46331 net/sched actpedit 부분 COW 페이지 캐시 손상 범인 커밋 899ee91156e5, v5.18부터 v7.1-rc7에서 수정됨. packeteditmeme.c는 이를 권한 없는 로컬 루트로 변환합니다: userns CAPNETADMIN 자식 프로세스가 setuid-root 바이너리의 캐시된 ELF 메타데이터를 setgid0+setuid0+execve"/bin/sh" 셸코드로 덮어씁니다. root@kitploit: make ./packeteditmeme...

cve-2026-46331-audit

cve-2026-46331-audit CVE-2026-46331 （別名 pedit COW ）用の読み取り専用監査スクリプト — Linux カーネルの net/sched の actpedit アクションに存在する部分的なコピーオンライト（COW）バグで、ローカルの非特権ユーザーがページキャッシュメモリを破壊し、root に権限昇格できるようにするものです。 root@kitploit: | | | \ | | / / \ \ / / | | | | | | | | | | | | | | | | \ \ /\ / / | /| || || | | | | | || || |...

CVE-2026-68138

CVE-2026-68138 — Linux kernel net/sched qdisc rate-table UAF 추적 사이트 CVE-2026-68138 패치 상태 추적기의 소스: Linux kernel의 net/sched qdisc rate-table use-after-free / double-free에 대한 수정 사항을 어떤 배포판이 출시했는지 기록하는 단일 페이지 사이트입니다. 실제 정보가 있는 곳 버그에 관한 모든 것 — CVE ID, 영향을 받는 버전 및 수정된 버전, 업스트림 수정 커밋, 발견 및 공개 크레딧, 그리고 현...

CVE-2026-46331

🚨 CVE-2026-46331 - 리눅스 커널 COW 버그 리눅스 커널 net/sched 부분적 Copy-on-Write COW 페이지 캐시 손상 -orange?style=for-the-badge 리눅스 커널 취약점으로, 트래픽 제어tc 패킷 편집 서브시스템의 잘못된 Copy-on-WriteCOW 처리로 인해 발생합니다. 📖 개요 CVE-2026-46331 은 리눅스 커널의 net/sched 패킷 편집actpedit 서브시스템에 영향을 미치는 취약점입니다. 이 취약점은 커널이 실제 패킷 편집 오프셋이 알려지기 전에 쓰기 가능한...

packet_edit_meme

PACKETEDITMEME - 일명 CVE-2026-46331 net/sched actpedit 부분 COW 페이지 캐시 손상 문제 제기: 899ee91156e5, v5.18부터 v7.1-rc7에서 수정됨. packeteditmeme.c는 이를 권한 없는 로컬 루트로 만듭니다: userns CAPNETADMIN 자식이 setuid-root /bin/su의 캐시된 ELF 엔트리를 setgid0+setuid0+execve"/bin/sh" 셸코드로 덮어씁니다. root@kitploit: make ./packeteditmeme...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: use skbheaderpointercareful skbheaderpointer does not fully validate negative @offset values. Use skbheaderpointercareful instead. GangMin Kim provided a report and a reproduction example for u32classify: Bug:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute The syzbot found that the TCAFLOWRSHIFT attribute was not validated. Shifting a 32-bit integer is undefined for large shift values. UBSAN: Shift-out-of-bounds in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netsched: schsfq: rejecting invalid perturb periods. Gerrard Tai reported that the perturbperiod of SFQ does not have a range check yet, and this could be exploited to trigger a race condition, which has been fixed in a separa...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In a rather strange API design decision, qdisc-destroy is called even if qdisc-init never succeeded. This isn’t exclusive to the commit 87b60cfacf9f “netsched:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actskbmod: prevent kernel-infoleak The syzbot discovered that tcfskbmoddump was copying four bytes from the kernel stack to user space 1. The issue here is that ‘struct tcskbmod’ has a four-byte hole. We need to cle...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: taprio: improper checking of the TCATAPRIOTCENTRYINDEX attribute The taprioparsetcentry function does not correctly check the TCATAPRIOTCENTRYINDEX attribute: int tc; // Signed value tc =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently, a race condition may occur, potentially leading to errors. Let’s illustrate this with an example where CPU0...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the net/sched/schcbq.c file of the Linux kernel, from version 6.1.4 onwards, cbqclassify allows attackers to cause a denial of service due to type confusion. Non-negative numbers can sometimes indicate a TCACTSHOT condition instead of valid classification results...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: It is enforced that teql can only be used as a root qdisc. The design intent of teql is that it is only supposed to be used as a root qdisc. Therefore, we need to ensure this constraint is respected. Although not very...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: Fixed incorrect qlen reduction in cakedrop In cakedrop, qdisctreereducebacklog is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cakeenqueue, assumes that the parent qdisc will enqueue...