CVE-2026-98010

Received Received - Intake

Integer Underflow in Linux Kernel DRR Scheduler

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock. Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved. Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98010

EUVD

EUVD-2026-86663

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Deficit Round Robin (DRR) traffic control qdisc. The flaw allows a local attacker with CAP_NET_ADMIN privileges to trigger a denial of service by causing a spin in the qdisc lock. The issue occurs when quantum is set to 1 or when psched_mtu returns zero, leading to excessive packet length calculations (~2 GiB) and CPU exhaustion.

Detection Guidance

Check if CONFIG_NET_SCH_DRR is enabled in your kernel configuration. Use 'grep CONFIG_NET_SCH_DRR /boot/config-$(uname -r)' to verify. If enabled, test for the vulnerability by running 'tc qdisc add dev dummy0 root drr' followed by 'tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1'. If the system becomes unresponsive or exhibits high CPU usage, the vulnerability may be present.

Impact Analysis

If you run a Linux system with CONFIG_NET_SCH_DRR enabled, an attacker with local access could exploit this to freeze the system by consuming all CPU resources in the kernel. This would make the system unresponsive until rebooted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network scheduling that could cause denial-of-service conditions under specific configurations. Compliance impacts would only occur if the vulnerability leads to system unavailability or data processing disruptions.

Mitigation Strategies

Apply the kernel patch that adds clamping to the quantum value in drr_change_class(). Update to a kernel version that includes this fix. Alternatively, disable the DRR qdisc module by ensuring CONFIG_NET_SCH_DRR is not set in your kernel configuration.

Hi! I’m here to help you understand CVE-2026-98010. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70