VulnerabilityPublished 21 Jan 2026Updated 19 Oct 2026

CVE-2026-22976: Linux kernel · NULL Pointer Dereference

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in cdb24200b043438a144df501f1ebbd926bb1a2c7 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:30 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

EPSS

0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-06-10.

Patch

Available – fixed in cdb24200b043438a144df501f1ebbd926bb1a2c7, c1d73b1480235731e35c81df70b08f4714a7d095, 43497313d0da3e12b5cfcd97aa17bf48ee663f95 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 21 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < cdb24200b043438a144df501f1ebbd926bb1a2c7	Fixed in cdb24200b043438a144df501f1ebbd926bb1a2c7
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < c1d73b1480235731e35c81df70b08f4714a7d095	Fixed in c1d73b1480235731e35c81df70b08f4714a7d095
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < 43497313d0da3e12b5cfcd97aa17bf48ee663f95	Fixed in 43497313d0da3e12b5cfcd97aa17bf48ee663f95
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < 6116a83ec167d3ab1390cded854d237481f41b63	Fixed in 6116a83ec167d3ab1390cded854d237481f41b63
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < 0809c4bc06c9c961222df29f2eccfd449304056f	Fixed in 0809c4bc06c9c961222df29f2eccfd449304056f
LinuxLinux	Affected ≥ 0545a3037773512d3448557ba048cebb73b3e4af, < 51ffd447bc37bf1a5776b85523f51d2bc69977f6	Fixed in 51ffd447bc37bf1a5776b85523f51d2bc69977f6

AI-suggested

A fix for this vulnerability is available in the Linux kernel as indicated by multiple fixed commit versions. Users and administrators should update their Linux kernel to a version that includes these fixes to prevent kernel crashes caused by this NULL pointer dereference. No additional mitigation steps are indicated or required beyond applying the official fix.

Description

A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's sch_qfq network scheduler. The flaw occurs when deactivating an inactive aggregate in the qfq_reset function due to incorrect assumptions about class activity and shared leaf_qdisc references. This can lead to kernel crashes (NULL pointer dereference) when certain qfq_class objects share the same leaf_qdisc and one is destroyed while the other is active.

CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.7 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 15:55 UTC

WeaknessesCWE-476

Technical details

References

Community reviews

Related threats