CVE-2026-90073

This Linux kernel vulnerability affects the net/sched hhf (Hierarchical Fair Queuing) scheduler. The root cause is that hhf_init() assigns the device MTU directly to the quantum without an overflow check; a device with a very large MTU (e.g., a dummy device with max_mtu == 0 accepting MTU 2147483...

EUVD-2026-81919

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

EUVD-2026-81911

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initialquantum in change path The fq change path accepts TCAFQQUANTUM in 1, INTMAX and TCAFQINITIALQUANTUM up to INTMAX, while fqinit already clamps to 1, 120. A user can override the init clamp v...

CVE-2026-68138

CVE-2026-68138 — sitio de seguimiento del UAF de la tabla de tasas de qdisc net/sched del kernel de Linux Fuente del rastreador de estado de parches CVE-2026-68138 : un sitio de una sola página que registra qué distribuciones han publicado una corrección para el uso después de liberación / doble...

CVE-2025-21692-poc

CVE-2025-21692-poc This is code for my exploit of the CVE-2025-21692 ets qdisc vulnerability, which accompanies my writeup. Bear in mind that as specified in the writeup the kernel version was patched to enable the vulnerability, 6.6.75 is not vulnerable without removing the patch, but on older,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: qfq: A double addition of a classifier was corrected in the class, where netem is a child qdisc. As described in Gerrard’s report 1, there are use cases where a netem child qdisc can make the parent qdisc’s enqueue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In a rather strange API design decision, qdisc-destroy is called even if qdisc-init never succeeded. This isn’t exclusive to the commit 87b60cfacf9f “netsched:...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: schcake: A out-of-bounds access issue was fixed during the parsing of TCP options and headers. The TCP option parser in cake qdisc cakegettcpopt and caketcphmaydrop could read one byte out of bounds. When the length of the data...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In the net:sched section, there is a fix for the order of qlen adjustment. - Changes to sch-q.qlen related to qdisctreereducebacklog need to occur before a call to that function. Otherwise, it may fail to notify the parent...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pfifotailenqueue: Drop a new packet when sch-limit == 0. Expected behavior: If the scheduler’s limit is reached, pfifotailenqueue will drop a packet from the scheduler’s queue and decrease the scheduler’s qlen by one. Then, it wi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fixed the lockdep issue in qdisctreereducebacklog qdisctreereducebacklog is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup syzbot reported: WARNING: suspicious RCU usage...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: schhtb: Make htbqlennotify idempotent. htbqlennotify always disactivates the HTB class, and actually might trigger a warning if it is already disactivated. Therefore, it is not idempotent and is not friendly to its callers, like...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: prio: fix a race in priotune Gerrard Tai reported a race condition in PRIO, whenever the SFQ perturb timer fires at the wrong time. The race occurs as follows: CPU 0 CPU 1 1: lock root 2: qdisctreeFlushBacklog 3: unlock...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netem: Update sch-q.qlen before qdisctreereducebacklog. The qdisctreereducebacklog function only notifies the parent qdisc if the child qdisc becomes empty. Therefore, we need to reduce the backlog of the child qdisc before calli...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: ets: A double addition of the classifier was corrected in the class, where netem is a child qdisc. As described in Gerrard’s report 1, there are use cases where a netem child qdisc can make the enqueue callback of the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: It is enforced that teql can only be used as a root qdisc. The design intent of teql is that it is only supposed to be used as a root qdisc. Therefore, we need to ensure this constraint is respected. Although not very...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan discovered that etsclassfromarg can index an Out-Of-Bound class when the clid of 0 is passed. This may lead to local privilege escalation. 18.852298 ------------ Cut here ---...

CVE-2025-68325

CVE-2025-68325 schcake doesn't consider the case when cakeenqueue returns a non-null result, leading to the imbalanced qlen in the qdisc tree, triggering null-deref in its parent sched, e.g., qfq. Affected Versions Fixed at v6.19-rc1 Severity Low Patch root@kitploit: In cakedrop,...

CVE-2026-68138

CVE-2026-68138: condición de carrera en la tabla de tasas qdisc de Linux para escalar a root local Este repositorio contiene un exploit de prueba de concepto de escalada local de privilegios para CVE-2026-68138 , una condición de carrera en el código de la tabla de tasas del control de tráfico de...