< Back

CVE-2026-98012

Updated on 25 Sep 2026

Severity

5.5 Medium severity

Details

CVSS score
5.5
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sfq: clamp quantum in change path

sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, …) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp.

Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

Details

Affected product:
AlmaLinux 9.2 ESU , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
linux @ 5.10.271 (+3 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 12 Planned —
Debian 13 Released
17 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1
  • 6.12.105-1
  • 6.12.107-1