CVE ID :CVE-2026-45845<\/p>\n
Published : May 27, 2026, 11:16 a.m. | 1\u00a0hour, 15\u00a0minutes ago<\/p>\n
Description :In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: taprio: fix NULL pointer dereference in class dump<\/p>\n
When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft()
\nis called with new == NULL and stores NULL into q->qdiscs[cl – 1].
\nSubsequent RTM_GETTCLASS dump operations walk all classes via
\ntaprio_walk() and call taprio_dump_class(), which calls taprio_leaf()
\nreturning the NULL pointer, then dereferences it to read child->handle,
\ncausing a kernel NULL pointer dereference.<\/p>\n
The bug is reachable with namespace-scoped CAP_NET_ADMIN on any kernel
\nwith CONFIG_NET_SCH_TAPRIO enabled. On systems with unprivileged user
\nnamespaces enabled, an unprivileged local user can trigger a kernel
\npanic by creating a taprio qdisc inside a new network namespace,
\ngrafting an explicit child qdisc, deleting it, and requesting a class
\ndump. The RTM_GETTCLASS dump itself requires no capability.<\/p>\n
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN NOPTI
\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:taprio_dump_class (net\/sched\/sch_taprio.c:2478)
\n Call Trace:<\/p>\n
tc_fill_tclass (net\/sched\/sch_api.c:1966)
\n qdisc_class_dump (net\/sched\/sch_api.c:2326)
\n taprio_walk (net\/sched\/sch_taprio.c:2514)
\n tc_dump_tclass_qdisc (net\/sched\/sch_api.c:2352)
\n tc_dump_tclass_root (net\/sched\/sch_api.c:2370)
\n tc_dump_tclass (net\/sched\/sch_api.c:2431)
\n rtnl_dumpit (net\/core\/rtnetlink.c:6864)
\n netlink_dump (net\/netlink\/af_netlink.c:2325)
\n rtnetlink_rcv_msg (net\/core\/rtnetlink.c:6959)
\n netlink_rcv_skb (net\/netlink\/af_netlink.c:2550)<\/p>\n
Fix this by substituting &noop_qdisc when new is NULL in
\ntaprio_graft(), a common pattern used by other qdiscs (e.g.,
\nmultiq_graft()) to ensure the q->qdiscs[] slots are never NULL.
\nThis makes control-plane dump paths safe without requiring individual
\nNULL checks.<\/p>\n
Since the data-plane paths (taprio_enqueue and taprio_dequeue_from_txq)
\npreviously had explicit NULL guards that would drop\/skip the packet
\ncleanly, update those checks to test for &noop_qdisc instead. Without
\nthis, packets would reach taprio_enqueue_one() which increments the root
\nqdisc’s qlen and backlog before calling the child’s enqueue; noop_qdisc
\ndrops the packet but those counters are never rolled back, permanently
\ninflating the root qdisc’s statistics.<\/p>\n
After this change *old can be a valid qdisc, NULL, or &noop_qdisc.
\nOnly call qdisc_put(*old) in the first case to avoid decreasing
\nnoop_qdisc’s refcount, which was never increased.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID :CVE-2026-45845 Published : May 27, 2026, 11:16 a.m. | 1\u00a0hour, 15\u00a0minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: net\/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft() is called with new == NULL and stores NULL into q->qdiscs[cl …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-78921","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/78921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=78921"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/78921\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=78921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=78921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=78921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}