CVE-2026-43496
Kernel Panic in Linux Kernel's RED Qdisc with QFQ Child
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.1.0-rc1-00033-g46f74a3f7d57 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's network scheduler, specifically in the red (Random Early Detection) queuing discipline (qdisc) when it has child qdiscs such as qfq (Quick Fair Queueing). The issue arises because the red qdisc incorrectly calls the dequeue() method directly on its child qdisc instead of using the proper qdisc_dequeue_peeked() method after a peek() call. This improper call can lead to a kernel panic due to a null pointer dereference when the child qdisc tries to dequeue packets.
The problem occurs during packet retrieval: the parent qdisc does a peek() to check if the child has packets, and if so, it should dequeue the peeked packet safely. However, the red qdisc calls dequeue() directly, which causes the child qdisc to attempt to dequeue from an internal queue incorrectly, leading to a crash.
The fix replaces the direct dequeue call with the qdisc_dequeue_peeked() method, ensuring safe packet retrieval and preventing kernel panic.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic in the Linux operating system, leading to a system crash or reboot. Such instability can disrupt network operations, cause downtime, and potentially lead to loss of data or service availability.
If exploited or triggered, it could affect systems relying on the affected Linux kernel versions, especially those using the red qdisc with child qdiscs like qfq, impacting network traffic management and overall system reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel panic related to the red and qfq queuing disciplines in the Linux kernel. Detection involves monitoring system logs for kernel panic messages or KASAN (Kernel Address Sanitizer) null pointer dereference errors associated with sch_red and sch_qfq modules.
You can check the kernel logs for messages similar to the following, which indicate the vulnerability being triggered:
- dmesg | grep -i 'KASAN: null-ptr-deref'
- dmesg | grep -i 'sch_red'
- dmesg | grep -i 'sch_qfq'
Additionally, monitoring for kernel panics or crashes related to network traffic shaping or queuing disciplines may help detect attempts to exploit this issue.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version that includes the patch fixing this vulnerability. The patch replaces the direct dequeue call with a safer peek and qdisc_dequeue_peeked method to prevent kernel panic.
If updating the kernel is not immediately possible, consider disabling or avoiding the use of the red queuing discipline with children qdiscs such as qfq until the patch can be applied.
Monitoring system stability and avoiding network configurations that use the affected queuing disciplines can reduce the risk of triggering the vulnerability.