CVE-2026-23105

A kernel‑level issue in the Linux traffic scheduler qfq was patched to rely on the cl_is_active flag rather than a child queue’s length to determine whether a class is active. The change was intended to avoid problems that could arise from manipulating child qlen values, which might have led to improper code paths and kernel instability. The vulnerability could allow an attacker to trigger a fault or disrupt traffic scheduling, potentially causing a denial‑of‑service condition for processes interacting with the affected qdisc.

The problematic code lives in the Linux kernel scheduler. The provided CPE identifiers list the 6.19 release candidates (rc1 through rc6). Thus any system running the Linux kernel 6.19 RC1‑RC6 is affected; the patch is expected to correct the issue in later kernel releases as well.

The CVSS score of 7.8 indicates high severity, while the EPSS value of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because it resides in kernel‑space, exploitation would require local code execution or privileged operations on the affected system, and could lead to a kernel crash or re‑initialization of traffic scheduling, beyond which the system might suffer a denial‑of‑service state. The attack vector is therefore inferred to be local; the exploit would likely need the ability to interact with qfq qdiscs or craft packets that influence child queue state.