In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft() is called with new == NULL and stores NULL into q->qdiscs[cl - 1]. Subsequent RTM_GETTCLASS dump operations walk all classes via taprio_walk() and call taprio_dump_class(), which calls taprio_leaf() returning the NULL pointer, then dereferences it to read child->handle, causing a kernel NULL pointer dereference. The bug is reachable with namespace-scoped CAP_NET_ADMIN on any kernel with CONFIG_NET_SCH_TAPRIO enabled. On systems with unprivileged user namespaces enabled, an unprivileged local user can trigger a kernel panic by creating a taprio qdisc inside a new network namespace, grafting an explicit child qdisc, deleting it, and requesting a class dump. The RTM_GETTCLASS dump itself requires no capability. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:taprio_dump_class (net/sched/sch_taprio.c:2478) Call Trace: <TASK> tc_fill_tclass (net/sched/sch_api.c:1966) qdisc_class_dump (net/sched/sch_api.c:2326) taprio_walk (net/sched/sch_taprio.c:2514) tc_dump_tclass_qdisc (net/sched/sch_api.c:2352) tc_dump_tclass_root (net/sched/sch_api.c:2370) tc_dump_tclass (net/sched/sch_api.c:2431) rtnl_dumpit (net/core/rtnetlink.c:6864) netlink_dump (net/netlink/af_netlink.c:2325) rtnetlink_rcv_msg (net/core/rtnetlink.c:6959) netlink_rcv_skb (net/netlink/af_netlink.c:2550) </TASK> Fix this by substituting &noop_qdisc when new is NULL in taprio_graft(), a common pattern used by other qdiscs (e.g., multiq_graft()) to ensure the q->qdiscs[] slots are never NULL. This makes control-plane dump paths safe without requiring individual NULL checks. Since the data-plane paths (taprio_enqueue and taprio_dequeue_from_txq) previously had explicit NULL guards that would drop/skip the packet cleanly, update those checks to test for &noop_qdisc instead. Without this, packets would reach taprio_enqueue_one() which increments the root qdisc's qlen and backlog before calling the child's enqueue; noop_qdisc drops the packet but those counters are never rolled back, permanently inflating the root qdisc's statistics. After this change *old can be a valid qdisc, NULL, or &noop_qdisc. Only call qdisc_put(*old) in the first case to avoid decreasing noop_qdisc's refcount, which was never increased.

ubuntu_linux USN-8665-1: Ubuntu 24.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)

ubuntu_linux USN-8663-1: Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6355 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6355-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-22069 CVE-2025-68251 CVE-2025-68768 CVE-2025-71289                      CVE-2026-23247 CVE-2026-23272 CVE-2026-23346 CVE-2026-23394                      CVE-2026-23469 CVE-2026-31420 CVE-2026-31486 CVE-2026-31560                      CVE-2026-31613 CVE-2026-31663 CVE-2026-31717 CVE-2026-43116                      CVE-2026-43219 CVE-2026-43245 CVE-2026-43303 CVE-2026-43331                      CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841                      CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45845                      CVE-2026-45846 CVE-2026-45850 CVE-2026-45930 CVE-2026-46117                      CVE-2026-46137 CVE-2026-46158 CVE-2026-46160 CVE-2026-46170                      CVE-2026-46203 CVE-2026-46216 CVE-2026-46244 CVE-2026-46274                      CVE-2026-46275 CVE-2026-46315 CVE-2026-46316 CVE-2026-46319                      CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323                      CVE-2026-46331 CVE-2026-52908 CVE-2026-52909 CVE-2026-52910                      CVE-2026-52911

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.94-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via     RTM_DELQDISC, taprio_graft() is called with new == NULL and stores NULL into q->qdiscs[cl - 1]. Subsequent     RTM_GETTCLASS dump operations walk all classes via taprio_walk() and call taprio_dump_class(), which calls     taprio_leaf() returning the NULL pointer, then dereferences it to read child->handle, causing a kernel     NULL pointer dereference. The bug is reachable with namespace-scoped CAP_NET_ADMIN on any kernel with     CONFIG_NET_SCH_TAPRIO enabled. On systems with unprivileged user namespaces enabled, an unprivileged local     user can trigger a kernel panic by creating a taprio qdisc inside a new network namespace, grafting an     explicit child qdisc, deleting it, and requesting a class dump. The RTM_GETTCLASS dump itself requires no     capability. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000     [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP:
    0010:taprio_dump_class (net/sched/sch_taprio.c:2478) Call Trace: <TASK> tc_fill_tclass     (net/sched/sch_api.c:1966) qdisc_class_dump (net/sched/sch_api.c:2326) taprio_walk     (net/sched/sch_taprio.c:2514) tc_dump_tclass_qdisc (net/sched/sch_api.c:2352) tc_dump_tclass_root     (net/sched/sch_api.c:2370) tc_dump_tclass (net/sched/sch_api.c:2431) rtnl_dumpit     (net/core/rtnetlink.c:6864) netlink_dump (net/netlink/af_netlink.c:2325) rtnetlink_rcv_msg     (net/core/rtnetlink.c:6959) netlink_rcv_skb (net/netlink/af_netlink.c:2550) </TASK> Fix this by     substituting &noop_qdisc when new is NULL in taprio_graft(), a common pattern used by other qdiscs (e.g.,     multiq_graft()) to ensure the q->qdiscs[] slots are never NULL. This makes control-plane dump paths safe     without requiring individual NULL checks. Since the data-plane paths (taprio_enqueue and     taprio_dequeue_from_txq) previously had explicit NULL guards that would drop/skip the packet cleanly,     update those checks to test for &noop_qdisc instead. Without this, packets would reach     taprio_enqueue_one() which increments the root qdisc's qlen and backlog before calling the child's     enqueue; noop_qdisc drops the packet but those counters are never rolled back, permanently inflating the     root qdisc's statistics. After this change *old can be a valid qdisc, NULL, or &noop_qdisc. Only call     qdisc_put(*old) in the first case to avoid decreasing noop_qdisc's refcount, which was never increased.
    (CVE-2026-45845)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
321868	Debian dsa-6355 : ata-modules-6.12.90+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
317081	Linux Distros Unpatched Vulnerability : CVE-2026-45845	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-45845

medium

Tenable Plugins

Coming Soon

high

high

high

medium