CVE-2026-98011net/sched: hhf: clamp quantum in change and init paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow. Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 10239edf86f137ce4c39b62ea9575e8053c549a0 before a328698d046098e6f55b3b1460cac6bab577be58; from 10239edf86f137ce4c39b62ea9575e8053c549a0 before c364ad3ab3c8a6bce469a5cbf02881ab1324c5da; 10239edf86f137ce4c39b62ea9575e8053c549a0 builds before 2c6dd9fc86d446a03728c43f3b96d9ae29aa058f; 10239edf86f137ce4c39b62ea9575e8053c549a0 builds before 6570f326a6a96bedf3d1d1dab6acc9f8c29104ec; 10239edf86f137ce4c39b62ea9575e8053c549a0 builds before 1113b674307ffddd402524bd1fd9d7d5629b705b; 10239edf86f137ce4c39b62ea9575e8053c549a0 builds before 2e77947bbf6c166e76c038663832d0914418f761; 10239edf86f137ce4c39b62ea9575e8053c549a0 builds before 0898c6f9fa9ce2632ae88bd0f34a878ccc6335af; from 10239edf86f137ce4c39b62ea9575e8053c549a0 before eb56a495f59baf6cad5ed80e3ffb9078098b1346 | CNA record |
References
- https://git.kernel.org/stable/c/a328698d046098e6f55b3b1460cac6bab577be58
- https://git.kernel.org/stable/c/c364ad3ab3c8a6bce469a5cbf02881ab1324c5da
- https://git.kernel.org/stable/c/2c6dd9fc86d446a03728c43f3b96d9ae29aa058f
- https://git.kernel.org/stable/c/6570f326a6a96bedf3d1d1dab6acc9f8c29104ec
- https://git.kernel.org/stable/c/1113b674307ffddd402524bd1fd9d7d5629b705b
- https://git.kernel.org/stable/c/2e77947bbf6c166e76c038663832d0914418f761
- https://git.kernel.org/stable/c/0898c6f9fa9ce2632ae88bd0f34a878ccc6335af
- https://git.kernel.org/stable/c/eb56a495f59baf6cad5ed80e3ffb9078098b1346
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.