CVE-2026-98009
Received Received - Intake

Integer Overflow in Linux Kernel ETS Scheduler

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path. Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98009
EUVD
EUVD-2026-86662

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ETS (Enhanced Transmission Selection) qdisc (queueing discipline) implementation. When parsing quantum values for traffic classes, the system fails to properly clamp the quantum size, allowing it to reach extremely large values (~2 GiB). This can cause a denial-of-service condition by causing the deficit-refill loop to spin indefinitely under the qdisc lock, leading to system hangs or crashes.

Detection Guidance

To detect this vulnerability, check if CONFIG_NET_SCH_ETS is enabled in your kernel configuration. Use the command 'grep CONFIG_NET_SCH_ETS /boot/config-$(uname -r)' to verify. If enabled, test if the system is vulnerable by attempting to reproduce the conditions with 'tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1' as root. Monitor for excessive CPU usage or system hangs.

Impact Analysis

If you are running a Linux system with the CONFIG_NET_SCH_ETS kernel configuration enabled, an attacker with CAP_NET_ADMIN privileges could exploit this flaw to cause a denial-of-service by triggering the spinning loop. This could freeze or crash the system, disrupting services and requiring a reboot to recover.

Mitigation Strategies

Apply the latest kernel update that resolves this issue. If an update is unavailable, disable CONFIG_NET_SCH_ETS in your kernel configuration and recompile. Avoid using the ETS qdisc with crafted quantum values until patched. Restrict CAP_NET_ADMIN capabilities where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart