-

CVE-2026-98009

net/sched: ets: clamp quantum in parse and fallback paths

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: clamp quantum in parse and fallback paths

ets_qdisc_change() falls back to psched_mtu() with no floor for bands
without an explicit quantum. With a crafted size table qdisc_pkt_len
reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the
deficit-refill loop spin under the qdisc lock.

Move the floor into ets_quantum_parse() so explicitly configured quanta
are also clamped to [256, 1<<20], not just the fallback path.

Conditions to recreate the bug:
  CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 440b66cc7b56ea38e9b878ae88da91992efaa4c4
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 4ef8664eafafc8db68a1d52601f17dc008a223b7
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 8b8d782c3b96376217087767dcf662cd3d25f226
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 226d2702e74a570f5bfae6115b4706da4b94e5cf
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 99ae477b892e203a37985ebc56f0063e072f7f4b
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 8f80b113dea0bed3c1a31a4224b72775cd9ec52d
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < de22c30ec5598aca8797f02082d2ee1358dfa3ff
Status affected
Version dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Version < 1c38487f46b243bfeefec0c0c86023a3904f2214
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.6
Status affected
Version 0
Version < 5.6
Status unaffected
Version <= 5.10.*
Version 5.10.271
Status unaffected
Version <= 5.15.*
Version 5.15.222
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/99ae477b892e203a37985ebc56f0063e072f7f4b
https://git.kernel.org/stable/c/8f80b113dea0bed3c1a31a4224b72775cd9ec52d
https://git.kernel.org/stable/c/de22c30ec5598aca8797f02082d2ee1358dfa3ff
https://git.kernel.org/stable/c/1c38487f46b243bfeefec0c0c86023a3904f2214
https://git.kernel.org/stable/c/226d2702e74a570f5bfae6115b4706da4b94e5cf
https://git.kernel.org/stable/c/440b66cc7b56ea38e9b878ae88da91992efaa4c4
https://git.kernel.org/stable/c/4ef8664eafafc8db68a1d52601f17dc008a223b7
https://git.kernel.org/stable/c/8b8d782c3b96376217087767dcf662cd3d25f226