CVE-2026-80630

A flaw was found in the Linux kernel's fq_codel (Fair Queueing Controlled Delay) network scheduler. When fq_codel drops packets during a peek operation, it incorrectly calls qdisc_tree_reduce_backlog before restoring the queue length. This can lead to the parent's class being mistakenly deactivated, potentially causing a wild memory access and a general protection fault. An attacker could exploit this to cause a system crash, resulting in a Denial of Service.

fq_codel could call qdisc_tree_reduce_backlog during peek before restoring qlen after putting the skb back on gso_skb. If qlen temporarily reaches zero, the parent qdisc can run qlen_notify and incorrectly deactivate a class even though fq_codel still has a packet queued. In a qfq parent setup this can corrupt scheduler state and was observed as a KASAN wild memory access in qfq_deactivate_agg followed by a kernel oops. For the CVSS the PR:L is used for the paranoid score because an untrusted local user may be able to control qdisc state through a network namespace, container, or delegated CAP_NET_ADMIN rather than full host root. The issue is not directly network reachable and is triggered through local traffic control operations, but packet enqueue or peek behavior can be part of the trigger once the qdisc hierarchy is configured. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption like behavior, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.