Security readout for executives and security teams
Plain-English summary
A Linux traffic-control bug can cause the kernel to reuse memory after it has been freed when changing a QFQ scheduling class fails. A local user with sufficient access to reach this path could potentially crash the system or compromise confidentiality and integrity. Network-based exploitation is not indicated.
Executive priority
Treat as a high-priority local kernel vulnerability, especially on shared or multi-user systems. It is less urgent than an unauthenticated remote flaw, but potential impact spans system compromise and outage. Schedule prompt kernel updates after normal compatibility testing; accelerate where untrusted local access exists.
Technical view
The error path in qfq_change_class() may free an existing class and its qdisc when no new objects were allocated. Subsequent access can therefore become use-after-free. The supplied CVSS 3.1 score is 7.8, with local access, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Linux kernels containing the vulnerable sch_qfq implementation and systems where a local user can exercise QFQ class changes. The supplied affected-version data identifies multiple kernel lines but does not clearly express complete version ranges. Confirm applicability against the distribution's kernel build and security advisory.
Exploitation context
The supplied record does not list this CVE in CISA KEV and provides no evidence of active exploitation or a public exploit. The vulnerability is locally reachable according to its CVSS vector; exact operational prerequisites beyond reaching the affected QFQ path are not documented in the bundle.
Researcher notes
The root issue is incorrect ownership handling in an error case: existing cl and cl->qdisc objects must not be freed as though newly allocated. The bundle supplies seven stable-kernel fix commits but no CWE, reproducer, exploit evidence, or complete range semantics. Avoid inferring exact vulnerable boundaries from the flattened version list.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories because packaged kernel versions may not match upstream numbering.
- Prioritize systems allowing untrusted local workloads or delegated traffic-control access.
- Reboot into the updated kernel and verify the running version afterward.
Validation and detection
- Inventory running kernel versions across Linux systems.
- Determine whether each kernel includes the relevant upstream stable fix.
- Review whether untrusted users can reach QFQ traffic-control configuration paths.
- Confirm patched systems booted the updated kernel rather than an older installed image.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22999 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2a64fb9b47afffeb5dbab5fd3a518e1436dcc90eCVE reference, Linux
- https://git.kernel.org/stable/c/cff6cd703f41d8071995956142729e4bba160363CVE reference, Linux
- https://git.kernel.org/stable/c/f06f7635499bc806cbe2bbc8805c7cef8b1edddfCVE reference, Linux
- https://git.kernel.org/stable/c/0a234660dc70ce45d771cbc76b20d925b73ec160CVE reference, Linux
- https://git.kernel.org/stable/c/362e269bb03f7076ba9990e518aeddb898232e50CVE reference, Linux
- https://git.kernel.org/stable/c/e9d8f11652fa08c647bf7bba7dd8163241a332cdCVE reference, Linux
- https://git.kernel.org/stable/c/3879cffd9d07aa0377c4b8835c4f64b4fb24ac78CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.