CVE-2026-98009net/sched: ets: clamp quantum in parse and fallback paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path. Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 440b66cc7b56ea38e9b878ae88da91992efaa4c4; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 4ef8664eafafc8db68a1d52601f17dc008a223b7; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 8b8d782c3b96376217087767dcf662cd3d25f226; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 226d2702e74a570f5bfae6115b4706da4b94e5cf; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 99ae477b892e203a37985ebc56f0063e072f7f4b; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 8f80b113dea0bed3c1a31a4224b72775cd9ec52d; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before de22c30ec5598aca8797f02082d2ee1358dfa3ff; from dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 1c38487f46b243bfeefec0c0c86023a3904f2214 | CNA record |
References
- https://git.kernel.org/stable/c/440b66cc7b56ea38e9b878ae88da91992efaa4c4
- https://git.kernel.org/stable/c/4ef8664eafafc8db68a1d52601f17dc008a223b7
- https://git.kernel.org/stable/c/8b8d782c3b96376217087767dcf662cd3d25f226
- https://git.kernel.org/stable/c/226d2702e74a570f5bfae6115b4706da4b94e5cf
- https://git.kernel.org/stable/c/99ae477b892e203a37985ebc56f0063e072f7f4b
- https://git.kernel.org/stable/c/8f80b113dea0bed3c1a31a4224b72775cd9ec52d
- https://git.kernel.org/stable/c/de22c30ec5598aca8797f02082d2ee1358dfa3ff
- https://git.kernel.org/stable/c/1c38487f46b243bfeefec0c0c86023a3904f2214
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.