CVE-2026-23105: Linux Kernel QFQ Scheduler Vulnerability

CVE-2026-23105 Overview

A vulnerability has been identified and resolved in the Linux kernel's QFQ (Quick Fair Queueing) network scheduler subsystem. The issue lies in the qfq_rm_from_ag function, which previously relied on child qdisc's queue length (qlen) to determine whether a class is active, rather than using the dedicated cl_is_active function. This inconsistent approach creates potential exploitation vectors through child qlen manipulations.

Critical Impact

This vulnerability affects the Linux kernel's network traffic scheduling subsystem and could potentially be exploited through manipulation of queue length values to affect class activation states.

Affected Products

• Linux kernel with QFQ scheduler enabled
• Systems utilizing the net/sched QFQ traffic control mechanism
• Various Linux kernel versions prior to the security patches

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23105 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23105

Vulnerability Analysis

The vulnerability exists within the Linux kernel's QFQ packet scheduler implementation, specifically in how the qfq_rm_from_ag function determines whether a scheduling class is active. The core issue is an inconsistency in the codebase where the function relied on checking the child qdisc's queue length rather than utilizing the proper cl_is_active helper function designed for this purpose.

This inconsistency creates a potential attack surface where an adversary could manipulate child queue length values to influence class activation decisions. The QFQ scheduler is used for network traffic control and quality of service enforcement, making this a network-accessible component on affected systems.

Root Cause

The root cause is an implementation inconsistency in the qfq_rm_from_ag function. Instead of using the canonical cl_is_active function to determine class activation status, the code checked the child qdisc's queue length directly. This indirect method of determining activation state is susceptible to manipulation through child qlen modifications, potentially leading to unexpected scheduler behavior.

Attack Vector

The attack vector involves manipulating the child qdisc's queue length values to influence the class activation logic in the QFQ scheduler. While the exact exploitation methodology requires local access to configure traffic control settings, an attacker with sufficient privileges could potentially:

1. Craft specific qdisc configurations that manipulate queue lengths
2. Influence class activation decisions through qlen modifications
3. Potentially affect network traffic scheduling behavior

The vulnerability is described as preventive in nature, indicating the patch addresses a theoretical exploitation path rather than a known active exploit.

Detection Methods for CVE-2026-23105

Indicators of Compromise

• Unusual network traffic scheduling behavior on systems with QFQ scheduler enabled
• Unexpected changes to traffic control class activation states
• Anomalous qdisc queue length modifications or manipulations

Detection Strategies

• Monitor for unusual traffic control configuration changes using tc command auditing
• Implement kernel module integrity monitoring for sch_qfq module
• Enable system call auditing for setsockopt with traffic control options
• Review kernel logs for QFQ scheduler-related anomalies

Monitoring Recommendations

• Enable audit logging for network scheduler configuration changes
• Monitor /proc/net/sched/ entries for unexpected modifications
• Implement baseline monitoring for QFQ class activation patterns
• Deploy runtime kernel integrity monitoring solutions

How to Mitigate CVE-2026-23105

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• If kernel update is not immediately possible, consider disabling QFQ scheduler if not required
• Review and restrict access to traffic control configuration capabilities
• Monitor for unusual network scheduling behavior

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix modifies the qfq_rm_from_ag function to use the cl_is_active helper function instead of directly checking child qdisc queue length, ensuring consistent and manipulation-resistant class activation determination.

Multiple kernel commits address this issue across different kernel versions:

• Kernel Git Commit 77f1afd
• Kernel Git Commit 93b8635
• Kernel Git Commit abd9fc2
• Kernel Git Commit d837fbe

Workarounds

• Disable the QFQ scheduler module if not required: modprobe -r sch_qfq
• Use alternative schedulers such as FQ_CODEL or HTB for traffic control requirements
• Restrict traffic control configuration privileges to trusted administrators only
• Implement network namespace isolation to limit scheduler access

# Configuration example
# Disable QFQ scheduler module
modprobe -r sch_qfq

# Blacklist QFQ module to prevent loading
echo "blacklist sch_qfq" >> /etc/modprobe.d/blacklist-qfq.conf

# Verify QFQ is not loaded
lsmod | grep qfq