CVE-2026-98009
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path. Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-25 11:17:29.210000
Last modified
2026-10-19 10:17:52.293000
View original CVE JSON
{
"id": "CVE-2026-98009",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-25T11:17:29.210",
"lastModified": "2026-10-19T10:17:52.293",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: clamp quantum in parse and fallback paths\n\nets_qdisc_change() falls back to psched_mtu() with no floor for bands\nwithout an explicit quantum. With a crafted size table qdisc_pkt_len\nreaches ~2 GiB, so a zero psched_mtu on a headerless device makes the\ndeficit-refill loop spin under the qdisc lock.\n\nMove the floor into ets_quantum_parse() so explicitly configured quanta\nare also clamped to [256, 1<<20], not just the fallback path.\n\nConditions to recreate the bug:\n CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via\n unshare -Urn suffices).\n\n tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "440b66cc7b56ea38e9b878ae88da91992efaa4c4",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "4ef8664eafafc8db68a1d52601f17dc008a223b7",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "8b8d782c3b96376217087767dcf662cd3d25f226",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "226d2702e74a570f5bfae6115b4706da4b94e5cf",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "99ae477b892e203a37985ebc56f0063e072f7f4b",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "8f80b113dea0bed3c1a31a4224b72775cd9ec52d",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "de22c30ec5598aca8797f02082d2ee1358dfa3ff",
"versionType": "git",
"status": "affected"
},
{
"version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
"lessThan": "1c38487f46b243bfeefec0c0c86023a3904f2214",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c38487f46b243bfeefec0c0c86023a3904f2214",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/226d2702e74a570f5bfae6115b4706da4b94e5cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/440b66cc7b56ea38e9b878ae88da91992efaa4c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4ef8664eafafc8db68a1d52601f17dc008a223b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b8d782c3b96376217087767dcf662cd3d25f226",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f80b113dea0bed3c1a31a4224b72775cd9ec52d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/99ae477b892e203a37985ebc56f0063e072f7f4b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de22c30ec5598aca8797f02082d2ee1358dfa3ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}