CVE-2026-98010
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock. Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved. Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1
How to fix
- Linux Linuxe2297bbf9cf6ece86f1d1f8c683517a994990f9e, 560794ee6e040b6e1c4ac2b3c8909f341a4596ee, 23fea7e6736b2e1c6f6f2f05cccf33d36834da73, b464affe9f9dfe41ac48930c376e3fb8596651b0, dc8b374214ef5bba4882bbd95b361e42555cfc0d, d43cded350fe1218493ad3d37a276aff14108ae6, 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b, 8382abec0f1568d0a5590d75a3df92f23fcf5196 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < e2297bbf9cf6ece86f1d1f8c683517a994990f9e, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < 560794ee6e040b6e1c4ac2b3c8909f341a4596ee, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < 23fea7e6736b2e1c6f6f2f05cccf33d36834da73, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < b464affe9f9dfe41ac48930c376e3fb8596651b0, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < dc8b374214ef5bba4882bbd95b361e42555cfc0d, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < d43cded350fe1218493ad3d37a276aff14108ae6, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b, 13d2a1d2b032de08d7dcab6a1edcd47802681f96 ≤ v < 8382abec0f1568d0a5590d75a3df92f23fcf5196, 2.6.29 | e2297bbf9cf6ece86f1d1f8c683517a994990f9e, 560794ee6e040b6e1c4ac2b3c8909f341a4596ee, 23fea7e6736b2e1c6f6f2f05cccf33d36834da73, b464affe9f9dfe41ac48930c376e3fb8596651b0, dc8b374214ef5bba4882bbd95b361e42555cfc0d, d43cded350fe1218493ad3d37a276aff14108ae6, 8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b, 8382abec0f1568d0a5590d75a3df92f23fcf5196 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.