CVE-2026-22976

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the sch qfq module related to how it handles deactivation of inactive aggregates during a reset operation. Specifically, a NULL dereference can occur in the qfq deactivate agg function when a shared leaf qdisc is involved. This happens when two qfq class objects point to the same leaf qdisc, potentially triggered during operations like attaching a QFQ qdisc as a root qdisc and temporarily referencing another QFQ qdisc for destruction. This condition can lead to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.