-

CVE-2026-98013

net/sched: fq_pie: clamp quantum in change path

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_pie: clamp quantum in change path

fq_pie_change() accepts any quantum value from userspace, including 1.
With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1
makes the deficit-refill loop spin ~2^31 times under the qdisc lock
(a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change().

Conditions to recreate the bug:
  CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root fq_pie
  tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < ff4f3a0f3abd2ded467931d7da7984a68a768e0b
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < 749aaebc1eb92ce2f38fd3caf68a2f99686d84ef
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < 8fd98e56c41f79278eeb67512c28d7abc175bcf4
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < 215df1e953ae72a09d425ec188e054058ae23dc9
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < f90fe65b977e7aa9eb302230a09eb18f8c32ceaa
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < c11e3a39807eb5a200445ae9082843ab86800415
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < 6655b56e2801008566c594ef231f6c7b3f716c61
Status affected
Version ec97ecf1ebe485a17cd8395a5f35e6b80b57665a
Version < 4864f58c53eb47257d55e01f47d4a9f355f7f970
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.6
Status affected
Version 0
Version < 5.6
Status unaffected
Version <= 5.10.*
Version 5.10.271
Status unaffected
Version <= 5.15.*
Version 5.15.222
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa
https://git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415
https://git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61
https://git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970
https://git.kernel.org/stable/c/215df1e953ae72a09d425ec188e054058ae23dc9
https://git.kernel.org/stable/c/749aaebc1eb92ce2f38fd3caf68a2f99686d84ef
https://git.kernel.org/stable/c/8fd98e56c41f79278eeb67512c28d7abc175bcf4
https://git.kernel.org/stable/c/ff4f3a0f3abd2ded467931d7da7984a68a768e0b