CVE-2026-90073: net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: clamp quantum before hhfchange() to avoid overflow
hhfinit() sets q->quantum = pschedmtu(qdiscdev(sch)) with no overflow check. A device with a huge MTU (e.g. dummy with maxmtu == 0 accepting MTU 2147483634) makes weight quantum overflow the signed deficit in hhfdequeue(), spinning forever.
Clamp q->quantum before hhfchange() so both the opt and !opt paths see a sane quantum. Without this, bare "tc qdisc add ... hhf" succeeds with a clamped quantum but "tc qdisc add ... hhf limit 1000" (any option present) fails with -EINVAL because hhfchange() re-validates the unclamped default (schhhf.c:559). 256 matches fqcodel's floor and is a sane minimum for a DRR quantum.
Conditions to recreate the bug: a device whose MTU (plus hardheaderlen) wraps pschedmtu() into the sign bit (e.g. a dummy device with maxmtu == 0 accepting MTU 2147483634). Requires CAPNETADMIN in a user namespace.
Affected Software
Event History
Frequently Asked Questions
Who can realistically trigger this issue?
An attacker needs CAP_NET_ADMIN in a user namespace and access to a network device that accepts an extremely large MTU. The example given is a dummy device with max_mtu set to 0 that accepts an MTU of 2147483634.
What conditions cause the scheduler to become stuck?
The device MTU plus hard_header_len must cause psched_mtu() to wrap into the sign bit. When HHF processes traffic with the resulting quantum, weight multiplied by quantum can overflow its signed deficit value in hhf_dequeue(), causing it to spin indefinitely.
Is HHF affected when added with its default settings?
Yes. Adding an HHF qdisc without options succeeds with a clamped quantum, while adding it with any option, such as "limit 1000", can fail with -EINVAL because the previously unclamped default is revalidated.
What does the fix change?
The fix clamps the HHF quantum before hhf_change() runs, ensuring both the default and option-specified configuration paths use a sane quantum. It uses 256 as the minimum quantum floor.