CVE-2026-98011: net/sched: hhf: clamp quantum in change and init paths

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: clamp quantum in change and init paths

hhfchange() accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) in hhfchange() matching fqcodelchange(). Clamp hhfinit() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow.

Conditions to recreate the bug: CONFIGNETSCHHHF=y. Requires CAPNETADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 sizelog 15 celllog 0

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Clamp quantum to a minimum of 256 using max(256U, ...) in hhf_change(), and clamp the hhf_init() range to [256, 1<<20].

    Linux kernel HHF qdisc (sch_hhf) quantum = [256, 1<<20]

Event History

Sep 25, 2026
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Who can trigger the denial of service?

An attacker needs CAP_NET_ADMIN. This can be obtained within a local user and network namespace using unshare -Urn, so systems that permit unprivileged user namespaces may expose this capability to local unprivileged users.

2

Which configurations are affected?

The HHF queuing discipline must be enabled in the kernel with CONFIG_NET_SCH_HHF=y. Exploitation also requires the attacker to configure an HHF qdisc with a crafted size table and a quantum value of 1.

3

What is the impact of a successful exploit?

The deficit-refill loop can run roughly 2^31 times while holding the qdisc lock, causing a soft lockup and denial of service.

4

What can be done if the fix cannot be applied immediately?

Restrict CAP_NET_ADMIN and, where appropriate, disable or limit unprivileged user and network namespace creation. Avoid allowing untrusted users to create or modify HHF qdiscs, particularly with very small quantum values and crafted size tables.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203