CVE-2026-98012net/sched: sfq: clamp quantum in change path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp. Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa builds before 4117c528b2de5fdc3e4a7e3626815b616a635cdc; from 548cf048b426729a7a1fa6acd1271c010c9a7380 before f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0; from c49ac48fac51a6a54efd5963954d02bacf075085 before 0692ce5a528df450d64e9f819054177e9d91076f; from 58ae7465f0e7113d45aa88a66bf2d203c71c195e before e4192bcf83aaab02129644ddf4656fd86e93751f; from 82bd38bd5467ece1ee274b493f51326cf5220a5a before f3820dce042a673fcb28cc31c87ee14257e21a17; from e4650d7ae4252f67e997a632adfae0dd74d3a99a before 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72; from e4650d7ae4252f67e997a632adfae0dd74d3a99a before e6c1cb728e389354203a72bc77464c222a247aeb; from e4650d7ae4252f67e997a632adfae0dd74d3a99a before fb9f88a33c516ea5c0bcd9a22ca288b246b34567; and 7 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/4117c528b2de5fdc3e4a7e3626815b616a635cdc
- https://git.kernel.org/stable/c/f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0
- https://git.kernel.org/stable/c/0692ce5a528df450d64e9f819054177e9d91076f
- https://git.kernel.org/stable/c/e4192bcf83aaab02129644ddf4656fd86e93751f
- https://git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17
- https://git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72
- https://git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb
- https://git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.