CVE-2026-45845 Overview
CVE-2026-45845 is a NULL pointer dereference vulnerability in the Linux kernel's net/sched/sch_taprio.c Time-Aware Priority (TAPRIO) queueing discipline. The flaw occurs when a TAPRIO child qdisc is deleted via RTM_DELQDISC, causing taprio_graft() to store NULL into q->qdiscs[cl - 1]. Subsequent RTM_GETTCLASS dump operations invoke taprio_dump_class(), which dereferences the NULL pointer when reading child->handle and triggers a kernel panic.
Critical Impact
An unprivileged local user on systems with user namespaces enabled can trigger a kernel panic by creating a TAPRIO qdisc, grafting and deleting a child qdisc, and requesting a class dump.
Affected Products
- Linux kernel builds with CONFIG_NET_SCH_TAPRIO enabled
- Systems exposing unprivileged user namespaces with CAP_NET_ADMIN scoped capabilities
- Distributions shipping vulnerable mainline and stable kernels prior to the referenced fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45845 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45845
Vulnerability Analysis
The TAPRIO qdisc implements IEEE 802.1Qbv time-aware traffic scheduling in the Linux kernel networking stack. When user space deletes a child qdisc via RTM_DELQDISC, the kernel invokes taprio_graft() with the new parameter set to NULL, and the function writes NULL into the per-class slot q->qdiscs[cl - 1].
Later, when user space issues an RTM_GETTCLASS dump, the kernel walks every class via taprio_walk() and calls taprio_dump_class(). That handler calls taprio_leaf(), which returns the NULL pointer from the slot, and then dereferences it to read child->handle. The result is a general protection fault flagged by KASAN as a null-ptr-deref in the range [0x38-0x3f], matching the offset of the handle field.
The data-plane paths taprio_enqueue() and taprio_dequeue_from_txq() previously included explicit NULL guards, but the control-plane dump path lacked such checks. The fix substitutes &noop_qdisc for NULL inside taprio_graft(), mirroring the pattern used by multiq_graft(), so every slot in q->qdiscs[] always points to a valid qdisc.
Root Cause
The root cause is an inconsistent invariant on the q->qdiscs[] array. taprio_graft() allowed NULL writes, while consumers such as taprio_dump_class() assumed each slot held a valid struct Qdisc *. The dump path performed no NULL check before dereferencing child->handle [CWE-476].
Attack Vector
The bug is reachable through namespace-scoped CAP_NET_ADMIN. On systems where unprivileged user namespaces are enabled, a local user creates a new network namespace, instantiates a TAPRIO qdisc, grafts an explicit child qdisc, deletes the child, and then issues an RTM_GETTCLASS dump. The dump operation itself requires no capability, making the trigger trivial once the qdisc state is prepared. The result is a kernel general protection fault and denial of service.
The vulnerability is a kernel NULL pointer dereference reachable from local unprivileged code. No remote attack vector or code execution primitive is described in the upstream commit. See the kernel fix commit 3d07ca5 for the patch details.
Detection Methods for CVE-2026-45845
Indicators of Compromise
- Kernel Oops: general protection fault entries referencing taprio_dump_class in dmesg or /var/log/kern.log
- KASAN reports flagging null-ptr-deref in range [0x0000000000000038-0x000000000000003f] with RIP inside net/sched/sch_taprio.c
- Unexpected node reboots or panics correlated with tc class show or netlink RTM_GETTCLASS activity from unprivileged processes
Detection Strategies
- Audit tc qdisc operations involving TAPRIO from non-root UIDs, especially inside user-namespaced containers
- Monitor unshare, clone(CLONE_NEWUSER|CLONE_NEWNET), and subsequent netlink RTM_NEWQDISC/RTM_DELQDISC sequences targeting the taprio kind
- Correlate auditdnetlink events with kernel oops messages to identify trigger sequences
Monitoring Recommendations
- Forward kernel ring buffer and auditd logs to a centralized analytics platform to detect repeated panics on the same host
- Track kernel.unprivileged_userns_clone sysctl state across the fleet and flag hosts where it is enabled
- Alert on container workloads invoking tc against TAPRIO qdiscs without an operational requirement
How to Mitigate CVE-2026-45845
Immediate Actions Required
- Apply the upstream stable kernel patches that introduce the &noop_qdisc substitution in taprio_graft()
- Reboot affected hosts after patching to load the corrected kernel image
- Inventory hosts with CONFIG_NET_SCH_TAPRIO=y or =m and prioritize patching for multi-tenant or container-host systems
Patch Information
The fix is published across multiple stable trees. Relevant commits include 3d07ca5, 48b26d4, 8f1ff88, d02e2fb, and ec2501e. The patch replaces NULL writes with &noop_qdisc, updates data-plane guards to test against &noop_qdisc, and conditions qdisc_put(*old) on *old being a real qdisc to preserve noop_qdisc refcount integrity.
Workarounds
- Disable unprivileged user namespaces by setting sysctl kernel.unprivileged_userns_clone=0 on Debian/Ubuntu or user.max_user_namespaces=0 on other distributions
- Unload or blacklist the sch_taprio module on hosts that do not require time-aware traffic shaping
- Restrict CAP_NET_ADMIN inside container runtimes and drop the capability from workload profiles where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
