CVE-2026-98009: net/sched: ets: clamp quantum in parse and fallback paths
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: clamp quantum in parse and fallback paths
etsqdiscchange() falls back to pschedmtu() with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches ~2 GiB, so a zero pschedmtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.
Move the floor into etsquantumparse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path.
Conditions to recreate the bug: CONFIGNETSCHETS=y. Requires CAPNETADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs CAP_NET_ADMIN. This capability can be obtained within a local user and network namespace using unshare -Urn, so systems that permit unprivileged user namespaces may expose the issue to local unprivileged users.
What configurations are affected?
The ETS qdisc must be enabled in the kernel with CONFIG_NET_SCH_ETS=y. The issue involves ETS bands without an explicit quantum on a headerless device with a zero psched_mtu, and explicitly configured quantum values were also not consistently clamped before the fix.
What is the practical impact of exploitation?
A crafted size table can cause the deficit-refill loop to spin while holding the qdisc lock. This can result in a denial of service affecting packet scheduling on the affected device.
How can administrators check for exposure?
Check whether CONFIG_NET_SCH_ETS is enabled and whether users or workloads can obtain CAP_NET_ADMIN, including through unprivileged user and network namespaces. Systems that do not allow such capability access are not exposed to the described local attack path.