{"id":"CVE-2026-98013","published":"2026-09-25T11:17:29.660","lastModified":"2026-09-25T11:17:29.660","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq_pie: clamp quantum in change path\n\nfq_pie_change() accepts any quantum value from userspace, including 1.\nWith a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1\nmakes the deficit-refill loop spin ~2^31 times under the qdisc lock\n(a soft lockup / denial of service).\n\nAdd max(256U, ...) matching fq_codel_change().\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root fq_pie\n  tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970","tags":[]},{"url":"https://git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61","tags":[]},{"url":"https://git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415","tags":[]},{"url":"https://git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}