CVE-2026-74663

net/sched: reject overly deep qdisc hierarchies

State: Published
Severity: 7.8 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject overly deep qdisc hierarchies

Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent.

Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 08dc49df1527b09d9ea225a7265bbf6c237097bfAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a627d36c2a94e18c8c105ae68008786dfd85592eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9f69bb9fdaa2fe64b68bb62fb84d405784bee540Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8ca8cdb74939581339e1ae370193c0adb5a85336Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2759acf08a3454866660edcd3ef4e64139f254a6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a4b14a4df29d36458a943f9b521ddd0f940363ccAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e2d658c6427844cee5bc654b436ca68d680b6148Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 08dc49df1527b09d9ea225a7265bbf6c237097bfAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a627d36c2a94e18c8c105ae68008786dfd85592eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9f69bb9fdaa2fe64b68bb62fb84d405784bee540Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8ca8cdb74939581339e1ae370193c0adb5a85336Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2759acf08a3454866660edcd3ef4e64139f254a6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a4b14a4df29d36458a943f9b521ddd0f940363ccAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e2d658c6427844cee5bc654b436ca68d680b6148Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.