CVE-2026-98010net/sched: drr: clamp quantum in change class
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock. Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved. Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before e2297bbf9cf6ece86f1d1f8c683517a994990f9e; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 560794ee6e040b6e1c4ac2b3c8909f341a4596ee; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 23fea7e6736b2e1c6f6f2f05cccf33d36834da73; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before b464affe9f9dfe41ac48930c376e3fb8596651b0; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before dc8b374214ef5bba4882bbd95b361e42555cfc0d; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before d43cded350fe1218493ad3d37a276aff14108ae6; 13d2a1d2b032de08d7dcab6a1edcd47802681f96 builds before 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b; from 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 8382abec0f1568d0a5590d75a3df92f23fcf5196 | CNA record |
References
- https://git.kernel.org/stable/c/e2297bbf9cf6ece86f1d1f8c683517a994990f9e
- https://git.kernel.org/stable/c/560794ee6e040b6e1c4ac2b3c8909f341a4596ee
- https://git.kernel.org/stable/c/23fea7e6736b2e1c6f6f2f05cccf33d36834da73
- https://git.kernel.org/stable/c/b464affe9f9dfe41ac48930c376e3fb8596651b0
- https://git.kernel.org/stable/c/dc8b374214ef5bba4882bbd95b361e42555cfc0d
- https://git.kernel.org/stable/c/d43cded350fe1218493ad3d37a276aff14108ae6
- https://git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b
- https://git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.