In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

When sfb has children (eg qfq qdisc) whose peek() callback is
qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such
qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from
its child (sfb in this case), it will do the following:
 1a. do a peek() - and when sensing there's an skb the child can offer, then
     - the child in this case(sfb) calls its child's (qfq) peek.
        qfq does the right thing and will return the gso_skb queue packet.
        Note: if there wasnt a gso_skb entry then qfq will store it there.
 1b. invoke a dequeue() on the child (sfb). And herein lies the problem.
     - sfb will call the child's dequeue() which will essentially just
       try to grab something of qfq's queue.

[  127.594489][  T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
[  127.594741][  T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full)
[  127.595059][  T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  127.595254][  T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq]
[  127.595461][  T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b
[  127.596081][  T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216
[  127.596337][  T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000
[  127.596623][  T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0
[  127.596917][  T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3
[  127.597165][  T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000
[  127.597404][  T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000
[  127.597644][  T453] FS:  00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000
[  127.597956][  T453] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  127.598160][  T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0
[  127.598390][  T453] PKRU: 55555554
[  127.598509][  T453] Call Trace:
[  127.598629][  T453]  <TASK>
[  127.598718][  T453]  ? mark_held_locks+0x40/0x70
[  127.598890][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599053][  T453]  sfb_dequeue+0x88/0x4d0
[  127.599174][  T453]  ? ktime_get+0x137/0x230
[  127.599328][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599480][  T453]  ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq]
[  127.599670][  T453]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.599831][  T453]  tbf_dequeue+0x6b1/0x1098 [sch_tbf]
[  127.599988][  T453]  __qdisc_run+0x169/0x1900

The right thing to do in #1b is to grab the skb off gso_skb queue.
This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()
method instead.

https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e

https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9

https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997

https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0

https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae

https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e

https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318

https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_sfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"1e70274d3b81de28973bcdbce40a512bcb181ff9","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"e125f5980b730c67c92a30cf150ec8c3d6777318","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"6c153d97c100f5b282c424101d8ff63122306997","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"84bfbfc0c48731bcce74cdf4f9c497547ec525e0","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"9ad3288632c859cf84183199832d822e7a70bdae","versionType":"git","status":"affected"},{"version":"e13e02a3c68d899169c78d9a18689bd73491d59a","lessThan":"1b9bc71153b01dbde8045b9edede4240f4f5520e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_sfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]