net/sched: sfq: clamp quantum in change path
Summary
| CVE | CVE-2026-98012 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-25 11:17:29 UTC |
|---|
| Updated | 2026-09-25 11:17:29 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
net/sched: sfq: clamp quantum in change path
sfq_change() accepts any non-negative quantum (only rejects
(int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches
~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times
under the qdisc lock (a soft lockup / denial of service).
Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20
with -EINVAL, matching fq_codel_change() and the init clamp.
Conditions to recreate the bug:
CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via
unshare -Urn suffices).
tc qdisc add dev dummy0 root sfq
tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0 |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 82bd38bd5467ece1ee274b493f51326cf5220a5a f3820dce042a673fcb28cc31c87ee14257e21a17 git |
Not specified |
| CNA |
Linux |
Linux |
affected e4650d7ae4252f67e997a632adfae0dd74d3a99a 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72 git |
Not specified |
| CNA |
Linux |
Linux |
affected e4650d7ae4252f67e997a632adfae0dd74d3a99a e6c1cb728e389354203a72bc77464c222a247aeb git |
Not specified |
| CNA |
Linux |
Linux |
affected e4650d7ae4252f67e997a632adfae0dd74d3a99a fb9f88a33c516ea5c0bcd9a22ca288b246b34567 git |
Not specified |
| CNA |
Linux |
Linux |
affected 843cacb88f42f426973f1ed11c6fb562558efb27 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa git |
Not specified |
| CNA |
Linux |
Linux |
affected 548cf048b426729a7a1fa6acd1271c010c9a7380 git |
Not specified |
| CNA |
Linux |
Linux |
affected c49ac48fac51a6a54efd5963954d02bacf075085 git |
Not specified |
| CNA |
Linux |
Linux |
affected 58ae7465f0e7113d45aa88a66bf2d203c71c195e git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.12.13 6.12.111 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.4.297 5.5 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.10.239 5.11 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.15.186 5.16 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.1.129 6.2 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.76 6.7 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.13 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.13 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.111 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.53 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.7 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.