CVE-2026-74284

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Hierarchical Fair Service Curve (HFSC) scheduler where a class can be marked as passive twice during a single dequeue operation. This occurs when the child qdisc drops its last packets, causing the update vf() function to be called twice: first via hfsc qlen notify() and then via hfsc dequeue(). If the class is already passive during the second call, the go passive flag is armed again. This stale flag propagates to the parent, incorrectly decrementing its cl nactive count. Consequently, a parent with other active children may be removed from the vttree, causing the qdisc to stall and preventing further dequeuing of backlogged siblings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.