CVE-2026-98010

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: drr: clamp quantum in change class

drr_change_class() rejects explicit quantum==0 but falls back to

psched_mtu() with no floor. With a crafted size table qdisc_pkt_len

reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless

device) makes the deficit-refill loop spin under the qdisc lock.

Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the

fallback path. The explicit-zero reject is preserved.

Conditions to recreate the bug:

CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via

unshare -Urn suffices).

tc qdisc add dev dummy0 root drr

tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References