CVE-2026-64012

A flaw was found in the Linux kernel's Stochastic Fair Blue (SFB) queue discipline (net/sched: sch_sfb). This vulnerability occurs when the sfb component, acting as a parent queue, attempts to retrieve a network packet from its child queue using an incorrect dequeue function. This can lead to a null pointer dereference, causing a kernel panic and resulting in a denial of service (DoS) for the system.

This vulnerability is rated as Moderate impact because exploiting it requires an uncommon traffic control hierarchy using nested Stochastic Fair Blue and specialized child queue disciplines. Standard Red Hat Enterprise Linux installations do not configure this queuing discipline by default, and setting up network schedulers typically demands elevated privileges (CAP_NET_ADMIN). As a result, the impact is confined to a local denial of service via kernel crash without compromising system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.