CVE-2026-98012
Received Received - Intake

Denial of Service in Linux Kernel SFQ Scheduler

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp. Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98012
EUVD
EUVD-2026-86665

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SFQ (Stochastic Fairness Queueing) traffic control module. A crafted quantum value can cause a denial of service by triggering a soft lockup. The issue arises when quantum is set to 1, leading to an excessive loop in the deficit-refill mechanism under the qdisc lock.

Detection Guidance

To detect this vulnerability, check if CONFIG_NET_SCH_SFQ is enabled in your kernel configuration. Use the command 'grep CONFIG_NET_SCH_SFQ /boot/config-$(uname -r)' to verify. If enabled, attempt to reproduce the issue with the provided PoC commands under CAP_NET_ADMIN privileges.

Commands to test: 'tc qdisc add dev dummy0 root sfq' followed by 'tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0'. Monitor for soft lockups or system unresponsiveness.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges could exploit this to cause a denial of service on the affected system. This could lead to system unresponsiveness or crashes, disrupting network services and operations.

Mitigation Strategies

Apply the latest kernel patches that fix this issue. If patching is not immediately possible, disable the SFQ qdisc module by setting CONFIG_NET_SCH_SFQ to 'n' and recompiling the kernel. Restrict CAP_NET_ADMIN privileges to untrusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart