CVE-2026-23105 net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
A preventive fix in the Linux kernel's QFQ scheduler improves class activation logic to prevent potential exploits involving queue length manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23105?
CVE-2026-23105 is a high-severity vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.
Weakness: CWE-20
Which versions are affected by CVE-2026-23105?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23105?
Apply the vendor's patch.
Is CVE-2026-23105 being exploited?
There is no known exploitation of CVE-2026-23105 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77223, BELL-CVE-2026-23105, DEBIAN-CVE-2026-23105, GHSA-jvw7-84v9-fr93, ROOT-OS-DEBIAN-11-CVE-2026-23105, ROOT-OS-DEBIAN-12-CVE-2026-23105 and 4 more.