CVE-2026-22999

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-25)

CWE

CWE-416

Published

2026-01-25

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

Affected

• linux:linux_kernel

References

• https://git.kernel.org/stable/c/0a234660dc70ce45d771cbc76b20d925b73ec160
• https://git.kernel.org/stable/c/2a64fb9b47afffeb5dbab5fd3a518e1436dcc90e
• https://git.kernel.org/stable/c/362e269bb03f7076ba9990e518aeddb898232e50
• https://git.kernel.org/stable/c/3879cffd9d07aa0377c4b8835c4f64b4fb24ac78
• https://git.kernel.org/stable/c/cff6cd703f41d8071995956142729e4bba160363

Check your stackJSON