CVE-2026-80630: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80630 Overview

CVE-2026-80630 is a Linux kernel vulnerability in the net/sched subsystem, specifically in the sch_fq_codel queuing discipline. The flaw stems from incorrect ordering in the packet peek operation, where qdisc_tree_reduce_backlog is called before qlen is restored. When qlen drops to zero while peek still returns an skb, the parent's qlen_notify callback mistakenly deactivates the parent's class. This leads to wild memory access in qfq_deactivate_agg and general protection faults observed via KASAN in the sch_qfq module. The issue affects kernel traffic control paths used for network queue management.

Critical Impact
A local attacker manipulating traffic control (tc) qdisc configurations can trigger memory corruption in the kernel, resulting in denial of service or potential privilege escalation through wild memory access.

Affected Products

Linux kernel (upstream) with sch_fq_codel enabled
Linux distributions bundling vulnerable stable kernels prior to the fix commits
Systems using QFQ (sch_qfq) as a parent qdisc for FQ-CoDel

Discovery Timeline

2026-08-28 - CVE-2026-80630 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80630

Vulnerability Analysis

The vulnerability resides in the Fair Queuing Controlled Delay (FQ-CoDel) qdisc implementation in net/sched/sch_fq_codel.c. During a peek operation, if FQ-CoDel drops packets, it invokes qdisc_tree_reduce_backlog to notify the parent qdisc of the reduced backlog. The bug is that this notification occurs before qlen is reincremented to reflect the packet still on the queue that peek is about to return.

When the tracked qlen transiently reaches zero, the parent's qlen_notify callback is invoked. The parent qdisc (for example, QFQ) treats this as a signal to deactivate the associated class, removing bookkeeping structures from its internal aggregate lists. Subsequent operations on the still-active FQ-CoDel child then reference freed or poisoned list pointers.

KASAN reports confirm the outcome: a general protection fault in qfq_deactivate_agg with a poisoned list address (0xdead000000000122), triggered by list manipulation on a data structure that should no longer be linked. The corruption is reachable through standard traffic control operations such as tc qdisc graft or reset paths.

Root Cause

The root cause is an ordering error between backlog accounting and queue length restoration. qdisc_tree_reduce_backlog propagates state upward before the child's own qlen accurately reflects the packet remaining on the queue, causing the parent to make deactivation decisions based on stale data. This is a state consistency defect in kernel networking bookkeeping.

Attack Vector

Exploitation requires the ability to configure qdiscs, typically via the tc utility, which uses CAP_NET_ADMIN. In configurations where user namespaces or containers grant network administration privileges, an unprivileged process may reach the vulnerable code path. Triggering the flaw involves configuring FQ-CoDel as a child of a classful parent such as QFQ and forcing peek-time drops. The result is kernel memory corruption that can lead to a denial of service or, with additional primitives, escalation.

No public proof-of-concept exploit is currently available. Refer to the upstream commit series linked in the kernel git references for the exact call sequences that produce the fault.

Detection Methods for CVE-2026-80630

Indicators of Compromise

Kernel oops or general protection fault messages referencing qfq_deactivate_agg, qfq_reset_qdisc, or qdisc_reset in dmesg or journalctl -k output.
KASAN reports flagging wild memory access in the address range 0xdead000000000100-0xdead0000000001ff, which is the Linux list poison signature.
Unexpected kernel panics correlated with tc qdisc add, change, or graft operations involving FQ-CoDel and QFQ.

Detection Strategies

Monitor kernel logs for crash signatures involving sch_qfq and sch_fq_codel symbol resolution in stack traces.
Audit process execution of /sbin/tc and related netlink RTM_NEWQDISC messages, correlating with subsequent kernel warnings.
Track CAP_NET_ADMIN grants inside containers and user namespaces to identify unprivileged workloads with qdisc configuration ability.

Monitoring Recommendations

Enable kernel.panic_on_oops = 1 in high-assurance environments so corruption events are captured rather than silently continued.
Ship kernel ring buffer logs to a centralized SIEM or data lake and alert on general protection fault and KASAN strings.
Baseline legitimate qdisc configuration activity on production hosts and flag anomalous tc invocations from non-administrative accounts.

How to Mitigate CVE-2026-80630

Immediate Actions Required

Apply the upstream stable kernel updates that reorder the qdisc_tree_reduce_backlog call to occur after qlen restoration in sch_fq_codel.
Restrict CAP_NET_ADMIN inside containers and user namespaces where untrusted workloads execute.
Inventory hosts using FQ-CoDel with a classful parent qdisc such as QFQ and prioritize them for patching.

Patch Information

The fix is available across multiple stable branches. Reference the upstream commits: Kernel commit 0500af8630c3, commit 097f6fc7b1ae, commit 20dd591d8f95, commit 3e515188393e, commit 7c09843fd2b4, commit 94a5f1efdefb, commit acc08a0c7f37, and commit af54df2f44d9. Rebuild or update to a distribution kernel that incorporates these changes.

Workarounds

Avoid deploying FQ-CoDel as a child of QFQ until the patched kernel is installed; substitute a non-classful parent or an alternative qdisc.
Drop CAP_NET_ADMIN from unprivileged containers using seccomp or capability bounding sets to prevent attacker-controlled qdisc configuration.
Disable user namespace creation for unprivileged users on multi-tenant hosts by setting kernel.unprivileged_userns_clone = 0 where policy allows.

bash

# Configuration example
# Verify running kernel version and installed qdiscs
uname -r
tc qdisc show

# Restrict unprivileged user namespaces (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0

# Panic on kernel oops to capture corruption events
sysctl -w kernel.panic_on_oops=1