CVE-2026-98012net/sched: sfq: clamp quantum in change path
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp. Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0
Timeline
ID reserved
By Linux
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa – < 4117c528b2de5fdc3e4a7e3626815b616a635cdc
- affected 548cf048b426729a7a1fa6acd1271c010c9a7380 – < f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0
- affected c49ac48fac51a6a54efd5963954d02bacf075085 – < 0692ce5a528df450d64e9f819054177e9d91076f
- affected 58ae7465f0e7113d45aa88a66bf2d203c71c195e – < e4192bcf83aaab02129644ddf4656fd86e93751f
- affected 82bd38bd5467ece1ee274b493f51326cf5220a5a – < f3820dce042a673fcb28cc31c87ee14257e21a17
- affected e4650d7ae4252f67e997a632adfae0dd74d3a99a – < 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72
- affected e4650d7ae4252f67e997a632adfae0dd74d3a99a – < e6c1cb728e389354203a72bc77464c222a247aeb
- affected e4650d7ae4252f67e997a632adfae0dd74d3a99a – < fb9f88a33c516ea5c0bcd9a22ca288b246b34567
- affected 843cacb88f42f426973f1ed11c6fb562558efb27
- affected 5.10.239 – < 5.10.271
- affected 5.15.186 – < 5.15.222
- affected 6.1.129 – < 6.1.189
- affected 6.6.76 – < 6.6.158
- affected 6.12.13 – < 6.12.111
- affected 5.4.297 – < 5.5
- affected 6.13
- unaffected < 6.13
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/4117c528b2de5fdc3e4a7e3626815b616a635cdc (opens in a new tab)
- https://git.kernel.org/stable/c/f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0 (opens in a new tab)
- https://git.kernel.org/stable/c/0692ce5a528df450d64e9f819054177e9d91076f (opens in a new tab)
- https://git.kernel.org/stable/c/e4192bcf83aaab02129644ddf4656fd86e93751f (opens in a new tab)
- https://git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17 (opens in a new tab)
- https://git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72 (opens in a new tab)
- https://git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb (opens in a new tab)
- https://git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86665 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98012)Record last updated .