CVE-2026-22999: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22999 is a use-after-free (UAF) vulnerability in the Linux kernel's QFQ (Quick Fair Queueing) network scheduler, specifically in the qfq_change_class() function. The flaw was disclosed on January 25, 2026, and affects Linux kernel versions from 3.8 through 5.10.248, 5.11 through 5.15.198, 5.16 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.66, and 6.13 through 6.18.6, as well as pre-release versions 6.19-rc1 through 6.19-rc5. NIST NVD assigns a CVSS v3.1 base score of 5.5 (Medium), while the kernel.org CNA rates it 7.8 (High) due to potential confidentiality, integrity, and availability impacts (Red Hat Bugzilla, Feedly).

The root cause is improper memory management (use-after-free, CWE-416) in the qfq_change_class() function within net/sched/sch_qfq.c. In error-handling code paths, the function incorrectly frees cl->qdisc and cl (the scheduler class object) even when a new class and qdisc were not allocated — meaning it frees existing, still-referenced objects rather than newly allocated ones. This creates a UAF condition where freed memory can be accessed or manipulated. Exploitation requires local access with low privileges, as an attacker must be able to invoke network scheduler class manipulation via system calls (e.g., tc commands or netlink sockets) (Red Hat Bugzilla, Feedly).

Successful exploitation by a local low-privileged attacker can cause a kernel crash, resulting in a denial of service. The kernel.org CNA's higher CVSS score (7.8 High) reflects that the UAF condition could also potentially be leveraged for kernel data structure modification or information disclosure through memory corruption, though the primary confirmed impact is availability loss. The vulnerability is confined to the local system and does not directly enable remote code execution or lateral movement (Feedly).

Patches are available across all affected stable kernel branches. Administrators should update to the following fixed versions or later: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, or 6.19-rc6. Multiple stable kernel commits are available via git.kernel.org (e.g., 0a234660, 2a64fb9b, 362e269b, 3879cffd, cff6cd70, e9d8f116, f06f7635). If immediate patching is not feasible, restrict unprivileged local user access to network configuration interfaces and consider enforcing mandatory access control policies via SELinux or AppArmor to limit exposure (Feedly, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux distribution security teams, with advisories issued by SUSE, Ubuntu, Oracle Linux, and Amazon Linux. Multiple Nessus and Qualys detection plugins were published shortly after disclosure. No notable researcher commentary or significant social media discussion has been identified beyond standard CVE tracking and distribution-level patch announcements (Feedly).