UBUNTU-CVE-2026-74284

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

CVE-2026-74284

The CVE concerns the Linux kernel net/sched sch_hfsc subsystem. A bug could cause a class to be passived twice during a single dequeue: update_vf() is invoked twice for the same class (from hfsc_qlen_notify(0,0) and then hfsc_dequeue()), and if the child qdisc is empty, a second go_passive is arm...

CVE-2025-38177

CVE-2025-38177 affects the Linux kernel’s scheduling subsystem (sch_hfsc). The documented fix makes hfsc_qlen_notify() idempotent to improve safety for callers such as qdisc_tree_reduce_backlog(). The described changes include guarding update_vf() (checking cl_nactive) and safely removing RB node...