CVE-2026-98011
Received Received - Intake

Denial of Service in Linux Kernel HHF Qdisc

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow. Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98011
EUVD
EUVD-2026-86664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the net/sched: hhf component where the quantum value can be set to 1 by userspace. This causes a denial of service by making a loop spin excessively under the qdisc lock, leading to a soft lockup.

Detection Guidance

Check if CONFIG_NET_SCH_HHF is enabled in your kernel configuration. Use 'tc qdisc show' to inspect if hhf qdisc is active. Monitor for soft lockups or high CPU usage during qdisc operations.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges could exploit this to cause a denial of service on the system by triggering a soft lockup, which may freeze or severely slow down the affected system.

Mitigation Strategies

Update the Linux kernel to a patched version. Avoid using quantum=1 in hhf qdisc configurations. Restrict CAP_NET_ADMIN capabilities where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart