Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-98010 Details

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock. Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved. Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196	kernel.org
https://git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b	kernel.org
https://git.kernel.org/stable/c/d43cded350fe1218493ad3d37a276aff14108ae6	kernel.org
https://git.kernel.org/stable/c/dc8b374214ef5bba4882bbd95b361e42555cfc0d	kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes