CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

When sfb has children (eg qfq qdisc) whose peek() callback is
qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such
qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from
its child (sfb in this case), it will do the following:
 1a. do a peek() - and when sensing there's an skb the child can offer, then
     - the child in this case(sfb) calls its child's (qfq) peek.
        qfq does the right thing and will return the gso_skb queue packet.
        Note: if there wasnt a gso_skb entry then qfq will store it there.
 1b. invoke a dequeue() on the child (sfb). And herein lies the problem.
     - sfb will call the child's dequeue() which will essentially just
       try to grab something of qfq's queue.

[  127.594489][  T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
[  127.594741][  T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full)
[  127.595059][  T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  127.595254][  T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq]
[  127.595461][  T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b
[  127.596081][  T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216
[  127.596337][  T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000
[  127.596623][  T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0
[  127.596917][  T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3
[  127.597165][  T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000
[  127.597404][  T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000
[  127.597644][  T453] FS:  00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000
[  127.597956][  T453] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  127.598160][  T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0
[  127.598390][  T453] PKRU: 55555554
[  127.598509][  T453] Call Trace:
[  127.598629][  T453]  <TASK>
[  127.598718][  T453]  ? mark_held_locks+0x40/0x70
[  127.598890][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599053][  T453]  sfb_dequeue+0x88/0x4d0
[  127.599174][  T453]  ? ktime_get+0x137/0x230
[  127.599328][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599480][  T453]  ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq]
[  127.599670][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599831][  T453]  tbf_dequeue+0x6b1/0x1098 [sch_tbf]
[  127.599988][  T453]  __qdisc_run+0x169/0x1900

The right thing to do in #1b is to grab the skb off gso_skb queue.
This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()
method instead.

The Linux kernel CVE team has assigned CVE-2026-64012 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 5.10.259 with commit e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 5.15.210 with commit 1e70274d3b81de28973bcdbce40a512bcb181ff9
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 6.1.176 with commit e125f5980b730c67c92a30cf150ec8c3d6777318
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 6.6.143 with commit 6c153d97c100f5b282c424101d8ff63122306997
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 6.12.93 with commit 84bfbfc0c48731bcce74cdf4f9c497547ec525e0
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 6.18.35 with commit dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 7.0.12 with commit 9ad3288632c859cf84183199832d822e7a70bdae
	Issue introduced in 2.6.39 with commit e13e02a3c68d899169c78d9a18689bd73491d59a and fixed in 7.1 with commit 1b9bc71153b01dbde8045b9edede4240f4f5520e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64012
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sched/sch_sfb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57
	https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9
	https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318
	https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997
	https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0
	https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e
	https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae
	https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e