Answer in brief
CVE-2026-80630 records a Critical severity (CVSS 9.8) vulnerability in net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 6.15 | Not reported |
| Linux/Linuxgeneric | >=cc71a757da78dd4aa1b4a9b19cb011833730ccf2 <3e515188393e62a718ccebee651ee74514104ff6 || >=eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450 <20dd591d8f951e1e6aca5052be8785e6181055e2 || >=829c49b6b2ff45b043739168fd1245e4e1a91a30 <94a5f1efdefb01f82cd228bf4e7ef1e8fc075c80 || >=2f9761a94bae33d26e6a81b31b36e7d776d93dc1 <acc08a0c7f37ebb1901144e03a7cba7d4afd9203 || >=4d55144b12e742404bb3f8fee6038bafbf45619d <7c09843fd2b44d9bf0de798683861d1aecd62a08 || >=342debc12183b51773b3345ba267e9263bdfaaef <0500af8630c3253f0dde879bd3a73a06bb2f2b3f || >=342debc12183b51773b3345ba267e9263bdfaaef <af54df2f44d9605614bc7ed96640302a240a9a62 || >=342debc12183b51773b3345ba267e9263bdfaaef <097f6fc7b1ae362dd7a9444b2572162fda73b284 || 7a742a9506849d1c1aa71e36c89855ceddc7d58e || e73c838c80dccb9e4f19becc11d9f3cb4a27d483 || a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31 || >=5.10.241 <5.10.261 || >=5.15.190 <5.15.212 || >=6.1.135 <6.1.178 || >=6.6.88 <6.6.145 || >=6.12.24 <6.12.97 || >=5.4.297 <5.5 || >=6.13.12 <6.14 || >=6.14.3 <6.15 | 3e515188393e62a718ccebee651ee74514104ff6, 20dd591d8f951e1e6aca5052be8785e6181055e2, 94a5f1efdefb01f82cd228bf4e7ef1e8fc075c80, acc08a0c7f37ebb1901144e03a7cba7d4afd9203, 7c09843fd2b44d9bf0de798683861d1aecd62a08, 0500af8630c3253f0dde879bd3a73a06bb2f2b3f, af54df2f44d9605614bc7ed96640302a240a9a62, 097f6fc7b1ae362dd7a9444b2572162fda73b284, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 5.5, 6.14, 6.15 |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's qlen_notify callback will be executed even though fq_codel still has 1 packet on the queue and, thus, will mistakenly deactivate the parent's class causing issues like a recent report [1] and a wild memory access in qfq: [ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full) [ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq [ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216 [ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000 [ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000 [ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024 [ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000 [ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578 [ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000 [ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0 [ 29.376103][ T360] PKRU: 55555554 [ 29.376258][ T360] Call Trace: [ 29.376401][ T360] <TASK> ... [ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq [ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057) [ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096) [ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556) Fix this by only calling qdisc_tree_reduce_backlog in peek after the qlen is restored. [1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Quoted source text, attributed separately from HOL analysis.