CVE-2026-90076
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fq_init() computes quantum = 2 * psched_mtu() and initial_quantum = 10 * psched_mtu() with no overflow check. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000; the 2 * and 10 * multiplications wrap to 0 in 32-bit arithmetic, so q->quantum == 0. Then in fq_dequeue() the credit-refill loop adds 0 to f->credit (which stays <= 0) and goto begin loops forever under the qdisc lock, creating a soft lockup. Clamp psched_mtu() to [1, 1 << 20] before multiplying so the product cannot wrap, then cap the result at 1 << 20, matching the bound already enforced on TCA_FQ_QUANTUM in fq_change(). Conditions to recreate the bug: a device whose MTU (plus hard_header_len) is large enough that 2 * psched_mtu() wraps (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
How to fix
- Linux Linuxcf398f67d9caa71af3b9fb9319058b22fe6b524e, fd63409b669f9951f1cc6b02486a5254103800d1, d16dac3925be95ad46e986d4b139c9898b6e227f, f6b3e3848a5fca63438984acd6d9eceac80814c1, e35acd56f244d94355f9ab237c2ecc8fba5e6f04, 709f34f7c28dc4dd6c40343d101850f11e172312 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < cf398f67d9caa71af3b9fb9319058b22fe6b524e, afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < fd63409b669f9951f1cc6b02486a5254103800d1, afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < d16dac3925be95ad46e986d4b139c9898b6e227f, afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < f6b3e3848a5fca63438984acd6d9eceac80814c1, afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < e35acd56f244d94355f9ab237c2ecc8fba5e6f04, afe4fd062416b158a8a8538b23adc1930a9b88dc ≤ v < 709f34f7c28dc4dd6c40343d101850f11e172312, 3.12 | cf398f67d9caa71af3b9fb9319058b22fe6b524e, fd63409b669f9951f1cc6b02486a5254103800d1, d16dac3925be95ad46e986d4b139c9898b6e227f, f6b3e3848a5fca63438984acd6d9eceac80814c1, e35acd56f244d94355f9ab237c2ecc8fba5e6f04, 709f34f7c28dc4dd6c40343d101850f11e172312 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.