11 matches found
EUVD-2026-81911
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initialquantum in change path The fq change path accepts TCAFQQUANTUM in 1, INTMAX and TCAFQINITIALQUANTUM up to INTMAX, while fqinit already clamps to 1, 120. A user can override the init clamp v...
CVE-2026-68337: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...
CVE-2025-21700: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo...
PT-2025-6936
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, which allowed for the replacement of a child qdisc from one parent to another. This issue was discovered by Lion Ackermann, who w...
CVE-2024-53044
In the Linux kernel, the following vulnerability has been resolved: net/sched: schapi: fix xainsert error path in tcfblockgetext This command: $ tc qdisc replace dev eth0 ingressblock 1 egressblock 1 clsact Error: block dev insert failed: -EBUSY. fails because user space requests the same block...
CVE-2024-53044
CVE-2024-53044 affects the Linux kernel net/sched component (sch_api) and is tied to the tcf_block_get_ext() path. The root cause is an xa_insert() error handling route, which can mis-handle a failure when the same block index is requested for ingress and egress, leading to a busy block condition...
PT-2024-35509
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises when the tc qdisc command is used with the same block index for both ingress and egress, causing the xa insert function to fail. This failure leads to an irrecoverable...
CVE-2021-47595 net/sched: sch_ets: don't remove idle classes from the round-robin list
In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: don't remove idle classes from the round-robin list Shuang reported that the following script: 1 tc qdisc add dev ddd0 handle 10: parent 1: ets bands 8 strict 4 priomap 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 2 mauseza...
CVE-2022-48645
CVE-2022-48645 – Linux kernel ENETC offload: The TSN features (taprio, cbs, gate, police) could be configured via PF registers but were not intended to be accessible from VFs. Accessing VF-exposed registers could trigger kernel paging faults and a crash. The fix split enetc_setup_tc() into separa...
Null pointer dereference
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service system crash via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdiscgraft in...