CVE-2026-98234
Received
Received - Intake
Memory Exhaustion in Linux Kernel HHF Qdisc
Vulnerability report for CVE-2026-98234, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: cap hh_flows_limit at change time
hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge
hh_flows_limit lets each new heavy-hitter flow pass the
hh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size
kzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory
growth.
Bound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the
hhf_init() default) and report the rejected value via extack. The
deprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on
TCA_OPTIONS. Configs relying on hh_limit above the default were relying
on unbounded, unsafe behaviour and are not supported going forward.
hhf_init() also ran hhf_change() before setting the default
hh_flows_limit, so a user-supplied hh_limit at add time was clobbered
back to 2048. Set the default before hhf_change() so the configured
value sticks.
This is a follow-up to commit eb56a495f59b ("net/sched: hhf: clamp
quantum in change and init paths"), which bounded the quantum of the
same qdisc; the hh_flows_limit bound is the remaining unbounded knob of
that series' scope.
Conditions to recreate the bug: CAP_NET_ADMIN in a user namespace;
tc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the
value is echoed by tc qdisc show, unbounding heavy-hitter flow
allocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048
instead of 500.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 10239edf86f137ce4c39b62ea9575e8053c549a0 |
| Linux | Linux | 3.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
