CVE-2026-22999: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22999 Overview

CVE-2026-22999 is a use-after-free (UAF) vulnerability in the Linux kernel's Quick Fair Queueing (QFQ) packet scheduler. The flaw resides in the qfq_change_class() function within net/sched/sch_qfq.c. When the function takes an error path, it incorrectly frees an existing class structure (cl) and its associated queueing discipline (cl->qdisc) instead of only freeing newly allocated resources. A local attacker with CAP_NET_ADMIN capability in any user namespace can trigger this condition to cause memory corruption or denial of service. The issue affects Linux kernel versions through 6.19-rc5 and has been patched in stable kernel trees.

Critical Impact
Local users with network administration privileges can trigger kernel memory corruption, resulting in denial of service and potential further exploitation of freed kernel objects.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc5
Earlier stable Linux Kernel branches containing the QFQ scheduler
Distributions shipping vulnerable upstream kernel versions

Discovery Timeline

2026-01-25 - CVE-2026-22999 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-22999

Vulnerability Analysis

The QFQ (Quick Fair Queueing) scheduler is a Linux kernel traffic control queuing discipline used to provide bandwidth fairness between traffic classes. The qfq_change_class() function handles both class creation and modification through the tc (traffic control) interface using netlink.

The defect occurs along the error path of qfq_change_class(). When modifying an existing class, the function should only release newly allocated resources if the modification fails. Instead, the original code path frees the existing class object (cl) and its inner qdisc (cl->qdisc) even when no new allocation occurred. Subsequent kernel code paths continue to reference these freed objects, producing a use-after-free condition [CWE-416].

Root Cause

The root cause is improper resource lifecycle management in the error handling branch of qfq_change_class(). The function did not distinguish between the "create new class" path and the "modify existing class" path when deciding which objects to free. The patch ensures cl->qdisc and cl are released only when a new class and qdisc were freshly allocated within the call.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability, which is grantable inside unprivileged user namespaces on many distributions. An attacker invokes the tc interface via netlink to add a QFQ qdisc and then issues a class modification request crafted to trigger the error path in qfq_change_class(). The resulting use-after-free can produce kernel panics or be leveraged for memory corruption against adjacent freed slab objects.

No public proof-of-concept code or exploit is currently available. The vulnerability mechanism is described in prose because verified exploitation code has not been published. Refer to the upstream patches such as Kernel Patch 0a23466 and Kernel Patch f06f763 for the exact source-level fix.

Detection Methods for CVE-2026-22999

Indicators of Compromise

Kernel oops or panic messages referencing qfq_change_class, qfq_destroy_class, or sch_qfq in dmesg and /var/log/kern.log
KASAN reports identifying use-after-free reads or writes in QFQ scheduler functions
Unexpected termination or restart of networking services after tc qdisc operations by non-root processes

Detection Strategies

Monitor audit logs (auditd) for tc invocations and netlink RTM_NEWTCLASS / RTM_NEWQDISC messages originating from unprivileged user contexts
Alert on creation of unprivileged user namespaces followed by CAP_NET_ADMIN-gated socket operations targeting AF_NETLINK with NETLINK_ROUTE
Track loading of the sch_qfq kernel module on hosts that do not normally use QFQ traffic shaping

Monitoring Recommendations

Enable kernel lockdown and KASAN in test environments to validate exposure to QFQ scheduler errors
Forward kernel ring buffer events to a centralized logging platform for correlation against process and user context
Baseline normal tc administrative activity and alert on deviations from expected operators or schedules

How to Mitigate CVE-2026-22999

Immediate Actions Required

Apply the upstream stable kernel patches and reboot affected systems at the next maintenance window
Restrict CAP_NET_ADMIN by disabling unprivileged user namespaces where operationally feasible via kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0
Inventory hosts running kernel versions in the 6.19-rc* series and other affected stable branches

Patch Information

Fixes have been merged into stable kernel trees. Relevant commits include Kernel Patch 0a23466, Kernel Patch 2a64fb9, Kernel Patch 362e269, Kernel Patch 3879cff, Kernel Patch cff6cd7, Kernel Patch e9d8f11, and Kernel Patch f06f763. Update to the patched stable release provided by your distribution vendor.

Workarounds

Blacklist the sch_qfq module on systems that do not require QFQ traffic shaping by adding install sch_qfq /bin/true to /etc/modprobe.d/
Disable unprivileged user namespaces to reduce the population of accounts able to obtain CAP_NET_ADMIN
Restrict access to tc and netlink route operations through SELinux, AppArmor, or seccomp policies on multi-tenant hosts

bash

# Configuration example: prevent loading of the vulnerable QFQ scheduler module
echo "install sch_qfq /bin/true" | sudo tee /etc/modprobe.d/disable-qfq.conf

# Disable unprivileged user namespaces to limit CAP_NET_ADMIN exposure
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee -a /etc/sysctl.d/99-harden.conf

# Verify running kernel version against patched releases
uname -r