Security readout for executives and security teams
Plain-English summary
CVE-2026-23105 is a Linux kernel flaw in the QFQ traffic scheduler. A local low-privileged user could potentially influence scheduler state in a way the kernel maintainers considered exploitable. The CVSS score is high, but the provided sources do not show active exploitation.
Executive priority
Treat as a high-priority kernel maintenance item, especially on systems with untrusted local users. There is no sourced evidence of active exploitation, so prioritize alongside normal high-severity Linux kernel patch cycles rather than emergency incident response.
Technical view
The QFQ scheduler’s qfq_rm_from_ag logic relied on a child qdisc qlen value to decide whether a class was active. The fix uses cl_is_active instead, making class activation state consistent and reducing risk from child qlen manipulation. CVSS indicates local access, low complexity, low privileges, no user interaction, and high CIA impact.
Likely exposure
Exposure is most relevant for Linux systems running affected kernel versions or branches with QFQ available. The provided record lists Linux kernel versions including 3.8 and several stable branch versions as affected, but it does not map distributions or packaged kernel names.
Exploitation context
The source says this was a preventive patch to prevent possible exploits using child qlen manipulation. KEV is false, and no cited source in the bundle confirms public exploitation or active attacks.
Researcher notes
The public record is sparse: no CWE, no exploit details, and no distro mapping are provided. Analysis should focus on the upstream scheduler change and affected branch coverage. Avoid assuming reachability beyond local, low-privilege access as stated by CVSS.
Mitigation direction
- Apply Linux stable or distribution kernel updates containing the referenced fixes.
- Check your Linux vendor advisory for exact package names and fixed builds.
- Prioritize multi-user servers, developer workstations, and shared hosting systems.
- Reduce unnecessary local user access where timely patching is blocked.
- Track the listed kernel stable commits against internally maintained kernels.
Validation and detection
- Inventory kernel versions across Linux assets.
- Confirm whether deployed kernels include one of the referenced stable fixes.
- Check whether QFQ support is enabled or available in relevant kernels.
- Review distro advisories for CVE-2026-23105 package status.
- Verify patched kernels are booted, not merely installed.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit fac2c67bb2bb732eae4283e45fc338af7e08c254
- Linux stable commit b8c24cf5268fb3bfb8d16324c3dbb985f698c835
- Linux stable commit f27047abf7cac1b6f90c3ad60de21ef9f717c26d
- Linux stable commit 93b8635974fb050c43d07e35e5edfe6e685ca28a
- Linux stable commit abd9fc26ea577561a5ef6241a1b058755ffdad0c
- Linux stable commit 77f1afd0bb4d5da95236f6114e6d0dfcde187ff6
- Linux stable commit d837fbee92453fbb829f950c8e7cf76207d73f33
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23105 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fac2c67bb2bb732eae4283e45fc338af7e08c254CVE reference, Linux
- https://git.kernel.org/stable/c/b8c24cf5268fb3bfb8d16324c3dbb985f698c835CVE reference, Linux
- https://git.kernel.org/stable/c/f27047abf7cac1b6f90c3ad60de21ef9f717c26dCVE reference, Linux
- https://git.kernel.org/stable/c/93b8635974fb050c43d07e35e5edfe6e685ca28aCVE reference, Linux
- https://git.kernel.org/stable/c/abd9fc26ea577561a5ef6241a1b058755ffdad0cCVE reference, Linux
- https://git.kernel.org/stable/c/77f1afd0bb4d5da95236f6114e6d0dfcde187ff6CVE reference, Linux
- https://git.kernel.org/stable/c/d837fbee92453fbb829f950c8e7cf76207d73f33CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.