All vulnerabilities
CVE-2026-98009

Linux: net/sched: ets: clamp quantum in parse and fallback paths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in440b66cc7b56ea38e9b878ae88da91992efaa4c4Also 4ef8664eafafc8db68a1d52601f17dc008a223b7, 8b8d782c3b96376217087767dcf662cd3d25f226 and 4 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 440b66cc7b56ea38e9b878ae88da91992efaa4c4LinuxCVE List
  • 4ef8664eafafc8db68a1d52601f17dc008a223b7LinuxCVE List
  • 8b8d782c3b96376217087767dcf662cd3d25f226LinuxCVE List
  • 226d2702e74a570f5bfae6115b4706da4b94e5cfLinuxCVE List
  • 99ae477b892e203a37985ebc56f0063e072f7f4bLinuxCVE List
  • 8f80b113dea0bed3c1a31a4224b72775cd9ec52dLinuxCVE List
Show all 7 fixed versions
  • 1c38487f46b243bfeefec0c0c86023a3904f2214LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: clamp quantum in parse and fallback paths

ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.

Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path.

Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1

Text from CVE List

Affected versions 18

  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 440b66cc7b56ea38e9b878ae88da91992efaa4c4CVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 4ef8664eafafc8db68a1d52601f17dc008a223b7CVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 8b8d782c3b96376217087767dcf662cd3d25f226CVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 226d2702e74a570f5bfae6115b4706da4b94e5cfCVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 99ae477b892e203a37985ebc56f0063e072f7f4bCVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 8f80b113dea0bed3c1a31a4224b72775cd9ec52dCVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before de22c30ec5598aca8797f02082d2ee1358dfa3ffCVE List
  • Linuxaffected: dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 before 1c38487f46b243bfeefec0c0c86023a3904f2214CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8