CVE-2026-80630

CVE CVE-2026-80630EUVD EUVD-2026-67506Published 2026-08-28T06:48:46.000ZLast changed 2026-08-29T06:21:30.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq: [ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057) [ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556) Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored. [1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 5.10.241 <5.10.261; 342debc12183b51773b3345ba267e9263bdfaaef <0500af8630c3253f0dde879bd3a73a06bb2f2b3f; patch: 5.10.261; patch: 6.12.97; e73c838c80dccb9e4f19becc11d9f3cb4a27d483; patch: 7.2; 2f9761a94bae33d26e6a81b31b36e7d776d93dc1 <acc08a0c7f37ebb1901144e03a7cba7d4afd9203; 4d55144b12e742404bb3f8fee6038bafbf45619d <7c09843fd2b44d9bf0de798683861d1aecd62a08; 5.4.297 <5.5; 6.12.24 <6.12.97; patch: 6.18.40; 6.14.3 <6.15; 6.1.135 <6.1.178; 342debc12183b51773b3345ba267e9263bdfaaef <af54df2f44d9605614bc7ed96640302a240a9a62; patch: 7.1.5; patch: 0; a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31; patch: 5.15.212; 342debc12183b51773b3345ba267e9263bdfaaef <097f6fc7b1ae362dd7a9444b2572162fda73b284; 6.13.12 <6.14; patch: 6.1.178; eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450 <20dd591d8f951e1e6aca5052be8785e6181055e2; 6.15; 5.15.190 <5.15.212; 7a742a9506849d1c1aa71e36c89855ceddc7d58e; patch: 6.6.145; cc71a757da78dd4aa1b4a9b19cb011833730ccf2 <3e515188393e62a718ccebee651ee74514104ff6; 829c49b6b2ff45b043739168fd1245e4e1a91a30 <94a5f1efdefb01f82cd228bf4e7ef1e8fc075c80; 6.6.88 <6.6.145

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.