CVE-2026-74267

A flaw was found in the Linux kernel's sch_codel (Controlled Delay) component, which manages network packet queues. When sch_codel processes packets, it can incorrectly reduce the queue's size before it is properly updated. This error can lead to the premature deactivation of a parent queue, such as qfq (Quick Fair Queueing), potentially causing a system crash due to memory access issues. A local attacker could exploit this to trigger a Denial of Service (DoS) on the affected system.

A state ordering bug in sch_codel can call qdisc_tree_reduce_backlog() during peek before the dequeued skb is requeued and qlen is restored. If qlen temporarily reaches zero, the parent qdisc can run qlen_notify and incorrectly deactivate a class even though Codel still has a packet queued. With qfq as a parent and codel as a child, this can leave scheduler class state inconsistent and later trigger wild memory access in qfq_deactivate_agg during reset or graft operations. For the CVSS the PR:L is used in the paranoid score because delegated CAP_NET_ADMIN inside containers or network namespaces may allow an untrusted local actor to configure the affected qdisc hierarchy, while a normal host setup is closer to PR:H. The issue is not directly network reachable and is triggered through local traffic control configuration and queue operations. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to stale list or UAF style memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.