CVE-2026-98013

net/sched: fq_pie: clamp quantum in change path

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_pie: clamp quantum in change path

fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change().

Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before ff4f3a0f3abd2ded467931d7da7984a68a768e0bAffected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 749aaebc1eb92ce2f38fd3caf68a2f99686d84efAffected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 8fd98e56c41f79278eeb67512c28d7abc175bcf4Affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 215df1e953ae72a09d425ec188e054058ae23dc9Affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before f90fe65b977e7aa9eb302230a09eb18f8c32ceaaAffected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before c11e3a39807eb5a200445ae9082843ab86800415Affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 6655b56e2801008566c594ef231f6c7b3f716c61Affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 4864f58c53eb47257d55e01f47d4a9f355f7f970Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before ff4f3a0f3abd2ded467931d7da7984a68a768e0bAffected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 749aaebc1eb92ce2f38fd3caf68a2f99686d84efAffected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 8fd98e56c41f79278eeb67512c28d7abc175bcf4Affected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 215df1e953ae72a09d425ec188e054058ae23dc9Affected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before f90fe65b977e7aa9eb302230a09eb18f8c32ceaaAffected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before c11e3a39807eb5a200445ae9082843ab86800415Affected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 6655b56e2801008566c594ef231f6c7b3f716c61Affected
ec97ecf1ebe485a17cd8395a5f35e6b80b57665a to before 4864f58c53eb47257d55e01f47d4a9f355f7f970Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.