CVE-2026-74284

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve (HFSC) queueing discipline (sch_hfsc). When a child qdisc drops its last packets, the update_vf() function can be called twice for the same class, causing it to be marked passive multiple times. This double transition can lead to a parent class being incorrectly removed from the virtual time tree (vttree), even if other active children exist. Consequently, the qdisc can stall, resulting in a denial of service (DoS) where packet processing ceases.

This flaw is rated as Low severity for Red Hat Enterprise Linux because exploitation requires elevated administrative privileges to configure traffic control hierarchies and results solely in a localized network stall without compromising system integrity or confidentiality. The Hierarchical Fair Service Curve (HFSC) queueing discipline is not configured or utilized by default on standard installations. Consequently, unprivileged remote attackers cannot trigger this condition, and the impact is confined to systems where an administrator has explicitly deployed HFSC with dropping child schedulers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.