All vulnerabilities
CVE-2026-98011

Linux: net/sched: hhf: clamp quantum in change and init paths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2c6dd9fc86d446a03728c43f3b96d9ae29aa058fAlso 6570f326a6a96bedf3d1d1dab6acc9f8c29104ec, 1113b674307ffddd402524bd1fd9d7d5629b705b and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2c6dd9fc86d446a03728c43f3b96d9ae29aa058fLinuxCVE List
  • 6570f326a6a96bedf3d1d1dab6acc9f8c29104ecLinuxCVE List
  • 1113b674307ffddd402524bd1fd9d7d5629b705bLinuxCVE List
  • 2e77947bbf6c166e76c038663832d0914418f761LinuxCVE List
  • 0898c6f9fa9ce2632ae88bd0f34a878ccc6335afLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: clamp quantum in change and init paths

hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow.

Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0

Text from CVE List

Affected versions 18

  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before a328698d046098e6f55b3b1460cac6bab577be58CVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before c364ad3ab3c8a6bce469a5cbf02881ab1324c5daCVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before 2c6dd9fc86d446a03728c43f3b96d9ae29aa058fCVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before 6570f326a6a96bedf3d1d1dab6acc9f8c29104ecCVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before 1113b674307ffddd402524bd1fd9d7d5629b705bCVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before 2e77947bbf6c166e76c038663832d0914418f761CVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before 0898c6f9fa9ce2632ae88bd0f34a878ccc6335afCVE List
  • Linuxaffected: 10239edf86f137ce4c39b62ea9575e8053c549a0 before eb56a495f59baf6cad5ed80e3ffb9078098b1346CVE List
  • Linuxaffected: 3.14CVE List
  • Linuxunaffected: all versions before 3.14CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8