CVE-2026-98013
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp quantum in change path fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0
How to fix
- Linux Linuxff4f3a0f3abd2ded467931d7da7984a68a768e0b, 749aaebc1eb92ce2f38fd3caf68a2f99686d84ef, 8fd98e56c41f79278eeb67512c28d7abc175bcf4, 215df1e953ae72a09d425ec188e054058ae23dc9, f90fe65b977e7aa9eb302230a09eb18f8c32ceaa, c11e3a39807eb5a200445ae9082843ab86800415, 6655b56e2801008566c594ef231f6c7b3f716c61, 4864f58c53eb47257d55e01f47d4a9f355f7f970 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < ff4f3a0f3abd2ded467931d7da7984a68a768e0b, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < 749aaebc1eb92ce2f38fd3caf68a2f99686d84ef, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < 8fd98e56c41f79278eeb67512c28d7abc175bcf4, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < 215df1e953ae72a09d425ec188e054058ae23dc9, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < f90fe65b977e7aa9eb302230a09eb18f8c32ceaa, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < c11e3a39807eb5a200445ae9082843ab86800415, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < 6655b56e2801008566c594ef231f6c7b3f716c61, ec97ecf1ebe485a17cd8395a5f35e6b80b57665a ≤ v < 4864f58c53eb47257d55e01f47d4a9f355f7f970, 5.6 | ff4f3a0f3abd2ded467931d7da7984a68a768e0b, 749aaebc1eb92ce2f38fd3caf68a2f99686d84ef, 8fd98e56c41f79278eeb67512c28d7abc175bcf4, 215df1e953ae72a09d425ec188e054058ae23dc9, f90fe65b977e7aa9eb302230a09eb18f8c32ceaa, c11e3a39807eb5a200445ae9082843ab86800415, 6655b56e2801008566c594ef231f6c7b3f716c61, 4864f58c53eb47257d55e01f47d4a9f355f7f970 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.