All vulnerabilities
CVE-2026-98013

Linux: net/sched: fq_pie: clamp quantum in change path

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in749aaebc1eb92ce2f38fd3caf68a2f99686d84efAlso 8fd98e56c41f79278eeb67512c28d7abc175bcf4, 215df1e953ae72a09d425ec188e054058ae23dc9 and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 749aaebc1eb92ce2f38fd3caf68a2f99686d84efLinuxCVE List
  • 8fd98e56c41f79278eeb67512c28d7abc175bcf4LinuxCVE List
  • 215df1e953ae72a09d425ec188e054058ae23dc9LinuxCVE List
  • 6655b56e2801008566c594ef231f6c7b3f716c61LinuxCVE List
  • 4864f58c53eb47257d55e01f47d4a9f355f7f970LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_pie: clamp quantum in change path

fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change().

Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0

Text from CVE List

Affected versions 18

  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before ff4f3a0f3abd2ded467931d7da7984a68a768e0bCVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before 749aaebc1eb92ce2f38fd3caf68a2f99686d84efCVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before 8fd98e56c41f79278eeb67512c28d7abc175bcf4CVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before 215df1e953ae72a09d425ec188e054058ae23dc9CVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before f90fe65b977e7aa9eb302230a09eb18f8c32ceaaCVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before c11e3a39807eb5a200445ae9082843ab86800415CVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before 6655b56e2801008566c594ef231f6c7b3f716c61CVE List
  • Linuxaffected: ec97ecf1ebe485a17cd8395a5f35e6b80b57665a before 4864f58c53eb47257d55e01f47d4a9f355f7f970CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8