CVE-2026-98427

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: codel: bound the dropping loop per dequeue call

The CoDel control law schedules the next drop one interval/sqrt(count)

after the previous drop, using the configured interval

(codel_params.interval). For very small intervals the scheduled step

rounds down to zero, so the dropping loop in codel_dequeue() never

advances and drains the entire backlog under the qdisc lock in one

call - an unprivileged user can trigger a soft lockup this way.

Fix in the shared codel code used by both codel and fq_codel:

1. Make the control-law step at least 1 tick so the dropping loop

always moves forward.

2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops

per codel_dequeue() call, resyncing drop_next to now when the cap

is hit: the catch-up owed to the loop grows with the idle gap and

the backlog, which no interval threshold can bound. This is a

deliberate behaviour change after long idle gaps

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References