CVE-2026-90050: net/sched: fq: clamp quantum and initial_quantum in change path
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq: clamp quantum and initialquantum in change path
The fq change path accepts TCAFQQUANTUM in [1, INTMAX] and TCAFQINITIALQUANTUM up to INTMAX, while fqinit() already clamps to [1, 1<<20]. A user can override the init clamp via tc qdisc change, restoring the small-quantum deficit spin that the init clamp prevents.
Narrow iqrange.max to 1<<20 so TCAFQINITIALQUANTUM is rejected at parse time. Clamp TCAFQQUANTUM to [256, 1<<20] in fqchange() and fqinit() quantum to [256, 1<<20] for tiny-MTU devices.
Conditions to recreate the bug: CONFIGNETSCHFQ=y. Requires CAPNETADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root fq tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 sizelog 15 celllog 0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel fq qdisc logic so that fq_change() clamps TCA_FQ_QUANTUM to the range [256, 1<<20], preventing invalid/small quantum values from bypassing the init clamp.
Linux kernel net/sched fq (fq_change()/fq_init()) TCA_FQ_QUANTUM = Clamp to [256, 1<<20] in fq_change() parse time - Configuration
Update the Linux kernel fq qdisc logic to narrow iq_range.max to 1<<20 so that TCA_FQ_INITIAL_QUANTUM is rejected when it exceeds 1<<20 (including cases up to INT_MAX that would otherwise be accepted on the change path).
Linux kernel net/sched fq (fq_change()/fq_init()) TCA_FQ_INITIAL_QUANTUM / iq_range.max = Narrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected above 1<<20 - Compensating control
Require CAP_NET_ADMIN for the affected fq qdisc change operation (namespace-local via unshare -Urn indicates the permission model); restrict tc qdisc change capability to trusted administrators/users only.
Event History
Frequently Asked Questions
Who can trigger the vulnerable configuration?
An attacker needs CAP_NET_ADMIN. This capability can be obtained within a local user and network namespace using unshare -Urn, so systems that allow unprivileged user namespaces may expose the issue to local users even when they lack administrative privileges on the host network namespace.
What kernel configuration and setup are required?
The kernel must be built with CONFIG_NET_SCH_FQ=y, and an fq qdisc must be configured on an interface. The documented reproduction uses a dummy interface and changes the fq quantum to 1 with tc.
What configuration values indicate exposure?
An fq qdisc changed through tc with a quantum below 256, particularly quantum 1, is affected by the small-quantum deficit-spin condition. Oversized initial_quantum values up to INT_MAX were also accepted through the change path before the fix.
What can be done before applying the fix?
Prevent untrusted users from obtaining CAP_NET_ADMIN in network namespaces, including by restricting unprivileged user namespaces where appropriate. Avoid fq qdisc change operations that set quantum below 256 or set initial_quantum above 1<<20.