NULL pointer dereference in Linux kernel - CVE-2026-64012
Published: July 20, 2026
Vulnerability identifier: #VU138626
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64012
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.
Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().
How to mitigate CVE-2026-64012
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e
- https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9
- https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997
- https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0
- https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae
- https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e
- https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318
- https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57