CVE-2026-22976: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22976 is a NULL pointer dereference vulnerability in the Linux kernel's QFQ (Quick Fair Queueing) packet scheduler (net/sched/sch_qfq). The flaw exists in the qfq_reset() function, which incorrectly attempts to deactivate an inactive aggregate when two QFQ qdisc objects share the same leaf_qdisc, leading to a kernel crash. It was disclosed on January 21, 2026, and affects Linux kernel versions from 3.0 through multiple stable branches up to (but not including) 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, and 6.18.6, as well as 6.19-rc1 through 6.19-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in qfq_reset() within net/sched/sch_qfq.c. The bug arises because the condition qfq_class->leaf_qdisc->q.qlen > 0 is incorrectly used to infer that a class is active — but two qfq_class objects can share the same leaf_qdisc. When one QFQ qdisc is the root and receives packets (incrementing the shared leaf_qdisc->q.qlen), a second QFQ qdisc pending destruction enters qfq_reset() with q->q.qlen == 0 but sees the shared leaf_qdisc->q.qlen > 0. This causes qfq_reset() to wrongly call qfq_deactivate_agg() on an inactive aggregate, dereferencing a NULL pointer at address 0x0000000000000000 (Red Hat Bugzilla). The attack vector is local and requires sending crafted netlink messages via tc (traffic control) commands, exploitable by a low-privileged user (Red Hat CVE).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service (DoS) for the affected host. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The attack requires only local access with low privileges, making it accessible to any unprivileged local user or container tenant on a vulnerable system (Red Hat Bugzilla, Red Hat CVE).

1. Gain local access: Obtain a low-privileged local shell on a vulnerable Linux system running an affected kernel version (3.0 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.65, 6.13 through 6.18.5, or 6.19-rc1 through 6.19-rc4).
2. Set up root QFQ qdisc: Use tc commands to attach a QFQ qdisc as the root qdisc on a network interface, and enqueue packets so that the shared leaf_qdisc->q.qlen is non-zero.
3. Trigger second QFQ qdisc reference: Invoke tc_new_tfilter or a similar netlink operation that causes a second QFQ qdisc to temporarily reference (via qdisc_get()/qdisc_put()) the same leaf_qdisc and enter a pending-destruction state.
4. Trigger qfq_reset(): Send crafted netlink messages (e.g., via rtnetlink) that cause qdisc_destroy() to be called on the second QFQ qdisc, entering qfq_reset() with q->q.qlen == 0 but shared leaf_qdisc->q.qlen > 0.
5. Kernel crash: The qfq_reset() function incorrectly calls qfq_deactivate_agg() on an inactive aggregate, dereferencing a NULL pointer and triggering a kernel panic, crashing the system (Red Hat Bugzilla).

• Logs: Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 followed by qfq_deactivate_agg in the call trace; oops messages referencing qfq_reset_qdisc, qdisc_reset, __qdisc_destroy, or tc_new_tfilter in /var/log/kern.log or dmesg output.
• Process: Unusual tc (traffic control) command invocations by low-privileged users, particularly those creating or modifying QFQ qdiscs on network interfaces.
• System: Unexpected system reboots or kernel panics on Linux hosts, especially those with QFQ packet scheduling configured (Red Hat Bugzilla).

Apply the available kernel security updates containing the fix for net/sched/sch_qfq. Patched versions include Linux kernel 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, and later; patches are available at git.kernel.org for all affected stable branches (Red Hat CVE). Distribution-specific updates are available from Red Hat, Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8296-2, USN-8278-2, USN-8289-2), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), Oracle Linux, and Microsoft (CBL-Mariner). As a temporary workaround where patching is not immediately possible, restrict local user access and disable the QFQ packet scheduler (sch_qfq kernel module) if it is not required for operations.