CVE-2026-64012: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64012 Overview

CVE-2026-64012 is a null pointer dereference vulnerability in the Linux kernel's net/sched subsystem, specifically in the sch_sfb (Stochastic Fair Blue) queueing discipline. The flaw occurs when sfb has child qdiscs such as qfq whose peek() callback is qdisc_peek_dequeued(). Under this configuration, a parent qdisc such as tbf triggering a peek followed by a direct dequeue leads to a kernel panic with a null pointer dereference in qfq_dequeue. The upstream fix replaces the direct dequeue call with qdisc_dequeue_peeked(), ensuring the previously peeked skb from the gso_skb queue is retrieved correctly.

Critical Impact
A local unprivileged process capable of configuring qdisc hierarchies (or triggering traffic through them) can panic the kernel, causing a denial of service on affected hosts.

Affected Products

Linux kernel mainline prior to the fix commits referenced in stable trees
Linux stable branches carrying sch_sfb and sch_qfq modules
Distributions shipping the affected kernel versions until backported patches land

Discovery Timeline

2026-07-19 - CVE-2026-64012 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64012

Vulnerability Analysis

The Linux traffic control subsystem allows qdiscs to be stacked hierarchically. When a parent qdisc such as Token Bucket Filter (tbf) requests a packet from its child sfb, it first invokes peek() and then dequeue(). The sfb implementation forwards the peek to its child (for example qfq), which stores the packet in the gso_skb queue and returns it. On the subsequent dequeue, sfb calls the child's dequeue() directly, bypassing the peeked skb held in gso_skb. In qfq_dequeue, this leads to a null pointer dereference in the range 0x48-0x4f, as captured by KASAN, terminating the kernel thread and panicking the system.

Root Cause

The root cause is a mismatch between the peek and dequeue semantics used by sfb_dequeue(). Children that implement peek() as qdisc_peek_dequeued() cache the peeked skb inside gso_skb. A subsequent direct call to the child's dequeue() operates on the internal queue rather than draining the cached skb, leaving the child's state inconsistent and dereferencing invalid pointers during processing.

Attack Vector

The attack vector is local. An actor with the ability to configure traffic control disciplines (typically CAP_NET_ADMIN in the affected namespace) can build a qdisc tree that pairs sfb with a child whose peek() uses qdisc_peek_dequeued(), such as qfq, under a parent that invokes peek before dequeue (for example tbf). Routine network traffic through the hierarchy is then sufficient to trigger the panic, as demonstrated by the KASAN report generated during a simple ping.

The vulnerability manifests in the sfb_dequeue() path when invoked after a peek operation. See the referenced upstream commits for the exact code changes that replace the direct dequeue call with qdisc_dequeue_peeked().

Detection Methods for CVE-2026-64012

Indicators of Compromise

Kernel panic messages referencing qfq_dequeue, sfb_dequeue, and tbf_dequeue in dmesg or /var/log/kern.log
KASAN reports of null-ptr-deref in range [0x0000000000000048-0x000000000000004f] during network activity
Unexpected host reboots or hangs correlated with traffic traversing custom qdisc hierarchies

Detection Strategies

Inventory hosts running vulnerable kernel versions using package managers (rpm -qa kernel, dpkg -l linux-image-*) and compare against fixed builds
Audit qdisc configurations with tc qdisc show for stacks that combine sfb with qfq under a parent such as tbf
Enable KASAN and panic-on-oops in test environments to surface latent occurrences before deploying kernels to production

Monitoring Recommendations

Ship kernel logs to a centralized logging pipeline and alert on BUG:, KASAN:, and general protection fault strings referencing sch_sfb or sch_qfq
Track unplanned reboots and kernel crash dumps on Linux fleets, correlating with recent tc configuration changes
Monitor CAP_NET_ADMIN usage and namespace creation events that could enable qdisc reconfiguration by non-root workloads

How to Mitigate CVE-2026-64012

Immediate Actions Required

Apply the fixed kernel packages from your distribution as soon as the backported patch is available
Remove or avoid qdisc hierarchies that combine sfb with children implementing qdisc_peek_dequeued() (notably qfq) until patched
Restrict CAP_NET_ADMIN in untrusted containers and network namespaces to limit who can reconfigure qdiscs

Patch Information

The fix is upstream and has been distributed across stable branches. Relevant commits include 1b9bc71, 1e70274, 6c153d9, 84bfbfc, 9ad3288, dbc5608, e125f59, and e5ea51e. The patch replaces the direct child dequeue() invocation in sfb_dequeue() with qdisc_dequeue_peeked(), correctly draining the gso_skb cache.

Workarounds

Delete affected sfb qdiscs with tc qdisc del dev <iface> root and use a queueing hierarchy that does not combine sfb with qfq under tbf
Prevent unprivileged users and containers from loading the sch_sfb and sch_qfq modules by blacklisting them via modprobe
Reboot into a kernel version that does not exhibit the panic if patched builds are not yet available for your distribution

bash

# Remove a vulnerable qdisc stack and blacklist the affected modules
tc qdisc del dev eth0 root
echo 'install sch_sfb /bin/true' | sudo tee /etc/modprobe.d/blacklist-sch_sfb.conf
echo 'install sch_qfq /bin/true' | sudo tee /etc/modprobe.d/blacklist-sch_qfq.conf
sudo update-initramfs -u