CVE-2026-98013
- Source
- https://cve.org/CVERecord?id=CVE-2026-98013
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98013.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98013
- Downstream
- Published
- 2026-09-25T10:23:36Z
- Modified
- 2026-09-26T03:48:31Z
- Summary
- net/sched: fq_pie: clamp quantum in change path
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq_pie: clamp quantum in change path
fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).
Add max(256U, ...) matching fq_codel_change().
Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98013.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970
- https://git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61
- https://git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415
- https://git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98013.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98013
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedec97ecf1ebe485a17cd8395a5f35e6b80b57665aFixedf90fe65b977e7aa9eb302230a09eb18f8c32ceaaFixedc11e3a39807eb5a200445ae9082843ab86800415Fixed6655b56e2801008566c594ef231f6c7b3f716c61Fixed4864f58c53eb47257d55e01f47d4a9f355f7f970