---
id: CVE-2026-23105
title: >-
  net/sched: qfq: Use cl_is_active to determine whether class is active in
  qfq_rm_from_ag
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  net/sched: qfq: Use cl_is_active to determine whether class is active in
  qfq_rm_from_ag


  This is more of a preventive patch to make the code more consistent and

  to prev…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    fac2c67bb2bb732eae4283e45fc338af7e08c254
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    b8c24cf5268fb3bfb8d16324c3dbb985f698c835
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    f27047abf7cac1b6f90c3ad60de21ef9f717c26d
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    93b8635974fb050c43d07e35e5edfe6e685ca28a
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    abd9fc26ea577561a5ef6241a1b058755ffdad0c
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    77f1afd0bb4d5da95236f6114e6d0dfcde187ff6
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    d837fbee92453fbb829f950c8e7cf76207d73f33
  - Linux 3.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-16T20:18:58.725662Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:31.225Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23105'
references:
  - url: 'https://git.kernel.org/stable/c/fac2c67bb2bb732eae4283e45fc338af7e08c254'
  - url: 'https://git.kernel.org/stable/c/b8c24cf5268fb3bfb8d16324c3dbb985f698c835'
  - url: 'https://git.kernel.org/stable/c/f27047abf7cac1b6f90c3ad60de21ef9f717c26d'
  - url: 'https://git.kernel.org/stable/c/93b8635974fb050c43d07e35e5edfe6e685ca28a'
  - url: 'https://git.kernel.org/stable/c/abd9fc26ea577561a5ef6241a1b058755ffdad0c'
  - url: 'https://git.kernel.org/stable/c/77f1afd0bb4d5da95236f6114e6d0dfcde187ff6'
  - url: 'https://git.kernel.org/stable/c/d837fbee92453fbb829f950c8e7cf76207d73f33'
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.03063
ingestedAt: '2026-10-19T18:35:50.103Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

This is more of a preventive patch to make the code more consistent and
to prevent possible exploits that employ child qlen manipulations on qfq.
use cl_is_active instead of relying on the child qdisc's qlen to determine
class activation.

## Affected

- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < fac2c67bb2bb732eae4283e45fc338af7e08c254`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < b8c24cf5268fb3bfb8d16324c3dbb985f698c835`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < f27047abf7cac1b6f90c3ad60de21ef9f717c26d`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 93b8635974fb050c43d07e35e5edfe6e685ca28a`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < abd9fc26ea577561a5ef6241a1b058755ffdad0c`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 77f1afd0bb4d5da95236f6114e6d0dfcde187ff6`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < d837fbee92453fbb829f950c8e7cf76207d73f33`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.