CVE-2026-90050net/sched: fq: clamp quantum and initial_quantum in change path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initial_quantum in change path The fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and TCA_FQ_INITIAL_QUANTUM up to INT_MAX, while fq_init() already clamps to [1, 1<<20]. A user can override the init clamp via tc qdisc change, restoring the small-quantum deficit spin that the init clamp prevents. Narrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected at parse time. Clamp TCA_FQ_QUANTUM to [256, 1<<20] in fq_change() and fq_init() quantum to [256, 1<<20] for tiny-MTU devices. Conditions to recreate the bug: CONFIG_NET_SCH_FQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root fq tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 size_log 15 cell_log 0
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d16dac3925be95ad46e986d4b139c9898b6e227f before a27498d34c3f429fb6db3aa609569f8154afa175; from f6b3e3848a5fca63438984acd6d9eceac80814c1 before 798283cd0fe7ba997f67e5a917f14ab40afa8d9f; from e35acd56f244d94355f9ab237c2ecc8fba5e6f04 before 72e9387884554f47b03bfd40fb8b2bf52789c68d; 709f34f7c28dc4dd6c40343d101850f11e172312 builds before 094cc07f98dfe70a34e2a1923af17fd29b8cf622 | CNA record |
References
- https://git.kernel.org/stable/c/a27498d34c3f429fb6db3aa609569f8154afa175
- https://git.kernel.org/stable/c/798283cd0fe7ba997f67e5a917f14ab40afa8d9f
- https://git.kernel.org/stable/c/72e9387884554f47b03bfd40fb8b2bf52789c68d
- https://git.kernel.org/stable/c/094cc07f98dfe70a34e2a1923af17fd29b8cf622
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.