CVE-2026-22999 — net/sched: sch_qfq: do not free existing class in qfq_change_class()
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. …
Published: 2026-01-25 · CVSS: 7.8 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7