CVE-2026-90075

net/sched: fq_codel: clamp default quantum and mtu

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_codel: clamp default quantum and mtu

fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which overflows the signed flow->deficit to INT_MIN in fq_codel_dequeue(), causing an infinite loop and soft lockup. Emulate fq_codel_change() and constrain to [256, FQ_CODEL_QUANTUM_MAX].

The same unclamped psched_mtu() is assigned to q->cparams.mtu a bit below, and fq_codel_change() never updates it. codel_should_drop() tests "*backlog <= params->mtu"; with mtu == 0x80000000 (~2 GiB) and the default 32 MiB memory_limit, the test is always true, so CoDel is silently and completely disabled (no drops, no ECN). Declare a single clamped mtu and assign both q->quantum and q->cparams.mtu from it, which also removes the double psched_mtu() call.

Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before d315ee8a07fd1810880227319cf60e6cd925ef22Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before a9a5b2943a00df2ab81a2209f31dd9e87016f120Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 3782067ec0d485628b6f1f9ede3eeeb4f611fcf2Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 397e2b1f71d9f15b8b4e47d24eb620e4dff8878dAffected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 324f86806673ae4a55f66d28db84577f46f615e1Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before dfb4b61db886917244284b18b44b23d2254b82c2Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9Affected 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before d9ebd8f9aa8b2773235889cb903fafd61f2d8585Affected
LinuxLinux	3.5Affected before 3.5Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before d315ee8a07fd1810880227319cf60e6cd925ef22Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before a9a5b2943a00df2ab81a2209f31dd9e87016f120Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 3782067ec0d485628b6f1f9ede3eeeb4f611fcf2Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 397e2b1f71d9f15b8b4e47d24eb620e4dff8878dAffected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 324f86806673ae4a55f66d28db84577f46f615e1Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before dfb4b61db886917244284b18b44b23d2254b82c2Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before 9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9Affected
4b549a2ef4bef9965d97cbd992ba67930cd3e0fe to before d9ebd8f9aa8b2773235889cb903fafd61f2d8585Affected

LinuxLinux

3.5Affected
before 3.5Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.