Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98012

net/sched: sfq: clamp quantum in change path

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 3 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp. Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa · fixed in 4117c528b2de5fdc3e4a7e3626815b616a635cdc; From 548cf048b426729a7a1fa6acd1271c010c9a7380 · fixed in f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0; From c49ac48fac51a6a54efd5963954d02bacf075085 · fixed in 0692ce5a528df450d64e9f819054177e9d91076f; From 58ae7465f0e7113d45aa88a66bf2d203c71c195e · fixed in e4192bcf83aaab02129644ddf4656fd86e93751f; From 82bd38bd5467ece1ee274b493f51326cf5220a5a · fixed in f3820dce042a673fcb28cc31c87ee14257e21a17; From e4650d7ae4252f67e997a632adfae0dd74d3a99a · fixed in 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72; From e4650d7ae4252f67e997a632adfae0dd74d3a99a · fixed in e6c1cb728e389354203a72bc77464c222a247aeb; From e4650d7ae4252f67e997a632adfae0dd74d3a99a · fixed in fb9f88a33c516ea5c0bcd9a22ca288b246b34567; From 5.10.239 · fixed in 5.10.271; From 5.15.186 · fixed in 5.15.222; From 6.1.129 · fixed in 6.1.189; From 6.6.76 · fixed in 6.6.158; From 6.12.13 · fixed in 6.12.111; From 5.4.297 · fixed in 5.5

  • Linux Linux

    6.13

  • KernelLinux

    fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; fixed in 7.2.7

References 8

git.kernel.org