Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-90073

net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhf_change() to avoid overflow hhf_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) with no overflow check. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes weight * quantum overflow the signed deficit in hhf_dequeue(), spinning forever. Clamp q->quantum before hhf_change() so both the opt and !opt paths see a sane quantum. Without this, bare "tc qdisc add ... hhf" succeeds with a clamped quantum but "tc qdisc add ... hhf limit 1000" (any option present) fails with -EINVAL because hhf_change() re-validates the unclamped default (sch_hhf.c:559). 256 matches fq_codel's floor and is a sane minimum for a DRR quantum. Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 2e0f0729f922c8de13801004e2131b57646c7c5f; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 0c66223e90ddb4fd3700965a9241f2fde7bd6bc7; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 20b65bf7ca06e48ec1d62ed8012f71205328dbe4; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in dea2789a9d5ff38bdd77f2e64d550430899e2839; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in fa9c2055f0a60f801ccf286af53d387dc6202c3f; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 99770b5d8e0e1c69b996f74a19d71afd2c4a9aa4; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 2446644b0f6d045b01db6acbaf55552dbec8a59a; From 10239edf86f137ce4c39b62ea9575e8053c549a0 · fixed in 2164b512b97bb053e8ce4d6e95576f11bed6a005

  • Linux Linux

    3.14

  • KernelLinux

    From 3.14.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8

git.kernel.org