CVE-2026-98009

net/sched: ets: clamp quantum in parse and fallback paths

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: clamp quantum in parse and fallback paths

ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.

Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path.

Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 440b66cc7b56ea38e9b878ae88da91992efaa4c4Affected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 4ef8664eafafc8db68a1d52601f17dc008a223b7Affected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 8b8d782c3b96376217087767dcf662cd3d25f226Affected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 226d2702e74a570f5bfae6115b4706da4b94e5cfAffected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 99ae477b892e203a37985ebc56f0063e072f7f4bAffected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 8f80b113dea0bed3c1a31a4224b72775cd9ec52dAffected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before de22c30ec5598aca8797f02082d2ee1358dfa3ffAffected dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 1c38487f46b243bfeefec0c0c86023a3904f2214Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 440b66cc7b56ea38e9b878ae88da91992efaa4c4Affected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 4ef8664eafafc8db68a1d52601f17dc008a223b7Affected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 8b8d782c3b96376217087767dcf662cd3d25f226Affected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 226d2702e74a570f5bfae6115b4706da4b94e5cfAffected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 99ae477b892e203a37985ebc56f0063e072f7f4bAffected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 8f80b113dea0bed3c1a31a4224b72775cd9ec52dAffected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before de22c30ec5598aca8797f02082d2ee1358dfa3ffAffected
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 to before 1c38487f46b243bfeefec0c0c86023a3904f2214Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.