CVE-2026-98011

net/sched: hhf: clamp quantum in change and init paths

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: clamp quantum in change and init paths

hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow.

Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	10239edf86f137ce4c39b62ea9575e8053c549a0 to before a328698d046098e6f55b3b1460cac6bab577be58Affected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before c364ad3ab3c8a6bce469a5cbf02881ab1324c5daAffected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before 2c6dd9fc86d446a03728c43f3b96d9ae29aa058fAffected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before 6570f326a6a96bedf3d1d1dab6acc9f8c29104ecAffected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before 1113b674307ffddd402524bd1fd9d7d5629b705bAffected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before 2e77947bbf6c166e76c038663832d0914418f761Affected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before 0898c6f9fa9ce2632ae88bd0f34a878ccc6335afAffected 10239edf86f137ce4c39b62ea9575e8053c549a0 to before eb56a495f59baf6cad5ed80e3ffb9078098b1346Affected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

10239edf86f137ce4c39b62ea9575e8053c549a0 to before a328698d046098e6f55b3b1460cac6bab577be58Affected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before c364ad3ab3c8a6bce469a5cbf02881ab1324c5daAffected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before 2c6dd9fc86d446a03728c43f3b96d9ae29aa058fAffected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before 6570f326a6a96bedf3d1d1dab6acc9f8c29104ecAffected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before 1113b674307ffddd402524bd1fd9d7d5629b705bAffected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before 2e77947bbf6c166e76c038663832d0914418f761Affected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before 0898c6f9fa9ce2632ae88bd0f34a878ccc6335afAffected
10239edf86f137ce4c39b62ea9575e8053c549a0 to before eb56a495f59baf6cad5ed80e3ffb9078098b1346Affected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.