CVE-2026-23105: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23105 is a denial-of-service vulnerability in the Linux kernel's QFQ (Quick Fair Queueing) network scheduler, specifically in the qfq_rm_from_ag function. The flaw arises from the function incorrectly relying on the child qdisc's queue length (qlen) to determine class activation status rather than using the proper cl_is_active check, creating an inconsistency exploitable via child queue length manipulation. It affects Linux kernel versions from 3.8 through multiple stable branches up to 6.18.7, and was published on February 4, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an improper state check in the net/sched/sch_qfq.c kernel subsystem: qfq_rm_from_ag uses the child qdisc's qlen value to infer whether a scheduling class is active, rather than calling cl_is_active. This inconsistency (broadly classified under CWE-20, improper input validation / incorrect state determination) allows a local attacker with low privileges to manipulate child queue lengths to influence scheduler behavior in unintended ways. The fix replaces the qlen-based check with the authoritative cl_is_active function call, making class activation determination consistent across the QFQ scheduler. Patch commits are available in the Linux kernel stable repository across multiple branches (Kernel Patches, Feedly).

Successful exploitation allows a local attacker with low privileges to cause a denial of service by manipulating child queue lengths in the QFQ scheduler, potentially leading to resource exhaustion or scheduler malfunction. The impact is limited to availability — there is no confidentiality or integrity impact — and the scope is unchanged, meaning the effect is confined to the affected kernel instance. Systems with untrusted local users (e.g., multi-tenant servers, container hosts) are at greatest risk (Feedly).

Apply the appropriate kernel update for your version branch:

• Kernel 3.8–5.10.x: update to 5.10.249 or later
• Kernel 5.11–5.15.x: update to 5.15.199 or later
• Kernel 5.16–6.1.x: update to 6.1.162 or later
• Kernel 6.2–6.6.x: update to 6.6.122 or later
• Kernel 6.7–6.12.x: update to 6.12.68 or later
• Kernel 6.13–6.18.x: update to 6.18.8 or later

Distribution-specific updates are available from Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE (SUSE-2026-0962-1), Oracle Linux (ELSA-2026-50160, ELSA-2026-50232), and Amazon Linux 2. As a workaround where patching is not immediately possible, restrict local user access to minimize the attack surface (Feedly, Ubuntu USN-8162-1).

The vulnerability has received routine coverage from Linux distribution security teams, with Ubuntu, SUSE, Oracle Linux, and Amazon Linux all issuing kernel update advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and scanner detection entries (Ubuntu USN-8162-1, Feedly).