All vulnerabilities
CVE-2026-98010

Linux: net/sched: drr: clamp quantum in change class

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in560794ee6e040b6e1c4ac2b3c8909f341a4596eeAlso 23fea7e6736b2e1c6f6f2f05cccf33d36834da73, 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 560794ee6e040b6e1c4ac2b3c8909f341a4596eeLinuxCVE List
  • 23fea7e6736b2e1c6f6f2f05cccf33d36834da73LinuxCVE List
  • 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80bLinuxCVE List
  • 8382abec0f1568d0a5590d75a3df92f23fcf5196LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: drr: clamp quantum in change class

drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock.

Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved.

Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1

Text from CVE List

Affected versions 18

  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before e2297bbf9cf6ece86f1d1f8c683517a994990f9eCVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 560794ee6e040b6e1c4ac2b3c8909f341a4596eeCVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 23fea7e6736b2e1c6f6f2f05cccf33d36834da73CVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before b464affe9f9dfe41ac48930c376e3fb8596651b0CVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before dc8b374214ef5bba4882bbd95b361e42555cfc0dCVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before d43cded350fe1218493ad3d37a276aff14108ae6CVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80bCVE List
  • Linuxaffected: 13d2a1d2b032de08d7dcab6a1edcd47802681f96 before 8382abec0f1568d0a5590d75a3df92f23fcf5196CVE List
  • Linuxaffected: 2.6.29CVE List
  • Linuxunaffected: all versions before 2.6.29CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8