UBUNTU-CVE-2026-90076: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit() computes quantum = 2 pschedmtu() and initialquantum = 10 pschedmtu() with no overflow check. A device with a huge MTU (e.g. dummy with maxmtu == 0 accepting MTU 2147483634) makes pschedmtu() return 0x80000000; the 2 and 10 multiplications wrap to 0 in 32-bit arithmetic, so q->quantum == 0. Then in fqdequeue() the credit-refill loop adds 0 to f->credit (which stays <= 0) and goto begin loops forever under the qdisc lock, creating a soft lockup. Clamp pschedmtu() to [1, 1 << 20] before multiplying so the product cannot wrap, then cap the result at 1 << 20, matching the bound already enforced on TCAFQQUANTUM in fqchange(). Conditions to recreate the bug: a device whose MTU (plus hardheaderlen) is large enough that 2 pschedmtu() wraps (e.g. a dummy device with maxmtu == 0 accepting MTU 2147483634). Requires CAPNETADMIN in a user namespace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In fq_init(), clamp psched_mtu() to [1, 1 << 20] before multiplying, then cap the computed quantum and initial quantum result at 1 << 20, matching the bound enforced on TCA_FQ_QUANTUM in fq_change().
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs CAP_NET_ADMIN in a user namespace. The issue can be recreated using a device that accepts an extremely large MTU, such as a dummy device with max_mtu set to 0.
What is the impact of successful exploitation?
A crafted oversized MTU can cause the fq scheduler quantum to become zero through integer overflow. When packets are dequeued, this can make the kernel loop indefinitely while holding the qdisc lock, resulting in a soft lockup and availability impact.
Are normal MTU configurations affected?
The described trigger requires an MTU large enough for twice psched_mtu() to wrap in 32-bit arithmetic. The example uses an MTU of 2147483634, so ordinary MTU values do not meet the stated trigger condition.
What can be done before applying an update?
Restrict CAP_NET_ADMIN within user namespaces and prevent untrusted users from creating or configuring network devices with exceptionally large MTUs. In particular, avoid dummy devices or other interfaces that permit the oversized MTU values needed to trigger the overflow.