CVE-2026-80630

9.8

Linux · Kernel

A race condition in the Linux kernel sch_fq_codel component leads to improper backlog tracking, potentially causing a general protection fault and wild memory access.

Executive summary

A critical vulnerability in the Linux kernel packet scheduler, specifically within sch_fq_codel, allows an attacker to trigger a system crash or potential memory corruption via a race condition.

Vulnerability

The vulnerability exists in the fq_codel queueing discipline, which incorrectly calls the qdisc_tree_reduce_backlog function before restoring the queue length during a packet peek operation. This logic error can lead to a premature deactivation of the parent class, resulting in a general protection fault and wild memory access.

Business impact

A successful exploit of this vulnerability could result in a kernel panic, leading to immediate system downtime and service unavailability. Given the CVSS score of 9.8, this flaw represents a significant risk to the stability of affected servers and networking infrastructure, as it can be triggered by unauthenticated network traffic.

Remediation

Immediate Action: Update the Linux kernel to the latest stable release containing the fix, specifically versions 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer.

Proactive Monitoring: Monitor system logs for kernel oops or general protection fault errors that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Ensure network traffic is inspected by robust security appliances to identify and drop malformed packets that might be used to trigger race conditions in network scheduling subsystems.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

Due to the critical nature of this kernel-level memory corruption vulnerability, all administrators should prioritize patching their Linux environments. Applying the provided kernel updates is the only definitive way to resolve the underlying logic error and prevent potential system crashes or future exploitation efforts.

More Linux CVEs

Sources