-

CVE-2026-98012

net/sched: sfq: clamp quantum in change path

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sfq: clamp quantum in change path

sfq_change() accepts any non-negative quantum (only rejects
(int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches
~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times
under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20
with -EINVAL, matching fq_codel_change() and the init clamp.

Conditions to recreate the bug:
  CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root sfq
  tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa
Version < 4117c528b2de5fdc3e4a7e3626815b616a635cdc
Status affected
Version 548cf048b426729a7a1fa6acd1271c010c9a7380
Version < f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0
Status affected
Version c49ac48fac51a6a54efd5963954d02bacf075085
Version < 0692ce5a528df450d64e9f819054177e9d91076f
Status affected
Version 58ae7465f0e7113d45aa88a66bf2d203c71c195e
Version < e4192bcf83aaab02129644ddf4656fd86e93751f
Status affected
Version 82bd38bd5467ece1ee274b493f51326cf5220a5a
Version < f3820dce042a673fcb28cc31c87ee14257e21a17
Status affected
Version e4650d7ae4252f67e997a632adfae0dd74d3a99a
Version < 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72
Status affected
Version e4650d7ae4252f67e997a632adfae0dd74d3a99a
Version < e6c1cb728e389354203a72bc77464c222a247aeb
Status affected
Version e4650d7ae4252f67e997a632adfae0dd74d3a99a
Version < fb9f88a33c516ea5c0bcd9a22ca288b246b34567
Status affected
Version 843cacb88f42f426973f1ed11c6fb562558efb27
Status affected
Version 5.10.239
Version < 5.10.271
Status affected
Version 5.15.186
Version < 5.15.222
Status affected
Version 6.1.129
Version < 6.1.189
Status affected
Version 6.6.76
Version < 6.6.158
Status affected
Version 6.12.13
Version < 6.12.111
Status affected
Version 5.4.297
Version < 5.5
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.13
Status affected
Version 0
Version < 6.13
Status unaffected
Version <= 5.10.*
Version 5.10.271
Status unaffected
Version <= 5.15.*
Version 5.15.222
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17
https://git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72
https://git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb
https://git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567
https://git.kernel.org/stable/c/0692ce5a528df450d64e9f819054177e9d91076f
https://git.kernel.org/stable/c/4117c528b2de5fdc3e4a7e3626815b616a635cdc
https://git.kernel.org/stable/c/e4192bcf83aaab02129644ddf4656fd86e93751f
https://git.kernel.org/stable/c/f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0