CVE-2026-90075net/sched: fq_codel: clamp default quantum and mtu
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_codel: clamp default quantum and mtu fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which overflows the signed flow->deficit to INT_MIN in fq_codel_dequeue(), causing an infinite loop and soft lockup. Emulate fq_codel_change() and constrain to [256, FQ_CODEL_QUANTUM_MAX]. The same unclamped psched_mtu() is assigned to q->cparams.mtu a bit below, and fq_codel_change() never updates it. codel_should_drop() tests "*backlog <= params->mtu"; with mtu == 0x80000000 (~2 GiB) and the default 32 MiB memory_limit, the test is always true, so CoDel is silently and completely disabled (no drops, no ECN). Declare a single clamped mtu and assign both q->quantum and q->cparams.mtu from it, which also removes the double psched_mtu() call. Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before d315ee8a07fd1810880227319cf60e6cd925ef22; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before a9a5b2943a00df2ab81a2209f31dd9e87016f120; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before 3782067ec0d485628b6f1f9ede3eeeb4f611fcf2; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before 397e2b1f71d9f15b8b4e47d24eb620e4dff8878d; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before 324f86806673ae4a55f66d28db84577f46f615e1; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before dfb4b61db886917244284b18b44b23d2254b82c2; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before 9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9; from 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe before d9ebd8f9aa8b2773235889cb903fafd61f2d8585 | CNA record |
References
- https://git.kernel.org/stable/c/d315ee8a07fd1810880227319cf60e6cd925ef22
- https://git.kernel.org/stable/c/a9a5b2943a00df2ab81a2209f31dd9e87016f120
- https://git.kernel.org/stable/c/3782067ec0d485628b6f1f9ede3eeeb4f611fcf2
- https://git.kernel.org/stable/c/397e2b1f71d9f15b8b4e47d24eb620e4dff8878d
- https://git.kernel.org/stable/c/324f86806673ae4a55f66d28db84577f46f615e1
- https://git.kernel.org/stable/c/dfb4b61db886917244284b18b44b23d2254b82c2
- https://git.kernel.org/stable/c/9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9
- https://git.kernel.org/stable/c/d9ebd8f9aa8b2773235889cb903fafd61f2d8585
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.