CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

EUVD-2026-58993

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

CVE-2026-72035 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

PT-2026-72702

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch dualpi2: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce...

PT-2026-72225

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch multiq: Replace direct dequeue call with peek and qdisc dequeue peeked multiq dequeue takes a packet from a band's child with a direct -dequeue call after multiq peek peeked it. When the child is non-work-conservin...

PT-2026-72224

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch taprio: Replace direct dequeue call with peek and qdisc dequeue peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso skb; taprio dequeue from txq...

PT-2026-72720

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch hfsc: Don't make class passive twice update vf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fq codel drops its last packets while dequeuing: 1. The...

PT-2026-72578

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch teql: Introduce slaves lock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql master xmit, teql dequeue, teql...

PT-2026-72246

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: preserve tc skb cb across defragmentation tcf ct handle fragments calls nf ct handle fragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tc skb cb/qdisc skb cb...

DEBIAN-CVE-2026-68441

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...

CVE-2026-68441 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...

CVE-2026-68441

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...

CVE-2026-68337

A flaw was found in the Linux kernel. The BPF Berkeley Packet Filter redirect helpers, specifically bpfredirect and skbdoredirect, can attempt to dereference a null pointer if a bpfnetcontext is not established. This can occur when certain BPF programs are attached to a network queueing disciplin...

CVE-2026-68138

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

CVE-2026-68138 net/sched: serialize qdisc_rtab_list against concurrent get/put

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove a drr class from the active list if it changes to strict. Whenever a user issues a ets qdisc change command, transforming a drr class into a strict one, the ets code does not check whether that class was in...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove the class from the active list before deleting it in etsqdiscchange. The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. This causes a Use-After-Freeze UAF error on the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: sched: avoiding a race condition for qdiscresetalltxgt when dealing with lockless qdiscs When reducing the number of real TX queues, the netifsetrealnumtxqueues function calls qdiscresetalltxgt to flush the qdiscs for queues...

CVE-2026-64530

CVE-2026-64530 affects the Linux kernel net/sched subsystem. The root cause is that tcf_qevent_handle() did not properly handle TC_ACT_CONSUMED, causing the skb to be returned to the caller as if classification passed, while the defragmentation engine still owned it. This led to a use-after-free ...