All vulnerabilities
CVE-2026-98012

Linux: net/sched: sfq: clamp quantum in change path

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4117c528b2de5fdc3e4a7e3626815b616a635cdcAlso 0692ce5a528df450d64e9f819054177e9d91076f, 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72 and 6 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sfq: clamp quantum in change path

sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp.

Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

Text from CVE List

Affected versions 25

  • Linuxaffected: 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa before 4117c528b2de5fdc3e4a7e3626815b616a635cdcCVE List
  • Linuxaffected: 548cf048b426729a7a1fa6acd1271c010c9a7380 before f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0CVE List
  • Linuxaffected: c49ac48fac51a6a54efd5963954d02bacf075085 before 0692ce5a528df450d64e9f819054177e9d91076fCVE List
  • Linuxaffected: 58ae7465f0e7113d45aa88a66bf2d203c71c195e before e4192bcf83aaab02129644ddf4656fd86e93751fCVE List
  • Linuxaffected: 82bd38bd5467ece1ee274b493f51326cf5220a5a before f3820dce042a673fcb28cc31c87ee14257e21a17CVE List
  • Linuxaffected: e4650d7ae4252f67e997a632adfae0dd74d3a99a before 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72CVE List
  • Linuxaffected: e4650d7ae4252f67e997a632adfae0dd74d3a99a before e6c1cb728e389354203a72bc77464c222a247aebCVE List
  • Linuxaffected: e4650d7ae4252f67e997a632adfae0dd74d3a99a before fb9f88a33c516ea5c0bcd9a22ca288b246b34567CVE List
  • Linuxaffected: 843cacb88f42f426973f1ed11c6fb562558efb27CVE List
  • Linuxaffected: 5.10.239 before 5.10.271CVE List
  • Linuxaffected: 5.15.186 before 5.15.222CVE List
  • Linuxaffected: 6.1.129 before 6.1.189CVE List
  • Linuxaffected: 6.6.76 before 6.6.158CVE List
  • Linuxaffected: 6.12.13 before 6.12.111CVE List
  • Linuxaffected: 5.4.297 before 5.5CVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8