CVE-2026-22999

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: do not free existing class in qfq_change_class()

Fixes qfq_change_class() error case.

cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.

A use-after-free can occur in sch_qfq when qfq_change_class() hits an error path that incorrectly frees an already-existing class/qdisc. An attacker with network administration capabilities (typically CAP_NET_ADMIN, often obtainable inside a user namespace) can trigger the bug via crafted tc class changes, leading to a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.