CVE-2026-90058

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

qdisc_get_stab() accepts a user-supplied size table, and

__qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the

overhead, the size-table data (u16), and size_log (up to

STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len()

to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as

DRR and ETS replenish one quantum per loop iteration; with a tiny

quantum (1) they spin billions of times under the qdisc lock,

producing a soft lockup / RCU stall as illustrated by [email protected].

Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table

amplification cannot drive deficit schedulers into an unbounded loop.

A legitimate size table (e.g. qfq's overhead 999999999, which is

handled by dropping) is still accepted.

Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above

any legitimate single-skb wire length:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References