ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses Linux Kernel QFQ Plus scheduler use-after-free (CVE-2026-22999, CVSS 7.8) enabling local privilege escalation on affected systems.
ZDI advisory ZDI-26-700 covers a use-after-free in the Linux Kernel QFQ Plus scheduler, tracked as CVE-2026-22999 with a CVSS score of 7.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to escalate privileges. No in-the-wild exploitation is mentioned.
30