qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMIN_LMAX.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-26668.json"