CVE-2026-90058

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

qdisc_get_stab() accepts a user-supplied size table, and
__qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the
overhead, the size-table data (u16), and size_log (up to
STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len()
to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as
DRR and ETS replenish one quantum per loop iteration; with a tiny
quantum (1) they spin billions of times under the qdisc lock,
producing a soft lockup / RCU stall as illustrated by vega@nebusec.ai.

Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table
amplification cannot drive deficit schedulers into an unbounded loop.
A legitimate size table (e.g. qfq's overhead 999999999, which is
handled by dropping) is still accepted.

Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above
any legitimate single-skb wire length: the largest current skb->len
is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax)
amplifies that to ~578 KB, both comfortably below 1 MiB. At the same
time, 1 MiB bounds the deficit refill loop to ~1M iterations per
packet with quantum=1, which completes in a few milliseconds well
under the demonstrated softlockup threshold (~10^9 iterations).

Conditions to recreate the bug:
- CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y).
- Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that
amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]).
- Add a class with a tiny quantum of 1 and send one small packet; the
deficit loop spins billions of times under the qdisc lock and trips
the softlockup detector (panic with kernel.softlockup_panic=1).
- Reachable as root or from an unprivileged user in a fresh user+net
namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4f0f4b09a95ef602fbdae948326beadd9c20eab3
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0bc5a6280a132a2170c6fa742436e01b635f02de
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 448c34421b38ec7c93a0060a885218ca319d382b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 82fdbf49b9f7528c82bf608cfa9710e5f81a198c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6e78792d8ce1fa3561713860ee8086901dde4f99
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1a5c26e586481bc82abc19ac92c3d9f10518f525
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 16d21a27df3f50b7251c9388fc5a7ab22703b469
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8f735d64382dcf162f4276d6699d03ad2f859c0b

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4f0f4b09a95ef602fbdae948326beadd9c20eab3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0bc5a6280a132a2170c6fa742436e01b635f02de)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,448c34421b38ec7c93a0060a885218ca319d382b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,82fdbf49b9f7528c82bf608cfa9710e5f81a198c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6e78792d8ce1fa3561713860ee8086901dde4f99)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1a5c26e586481bc82abc19ac92c3d9f10518f525)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,16d21a27df3f50b7251c9388fc5a7ab22703b469)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8f735d64382dcf162f4276d6699d03ad2f859c0b)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0bc5a6280a132a2170c6fa742436e01b635f02de
https://git.kernel.org/stable/c/16d21a27df3f50b7251c9388fc5a7ab22703b469
https://git.kernel.org/stable/c/1a5c26e586481bc82abc19ac92c3d9f10518f525
https://git.kernel.org/stable/c/448c34421b38ec7c93a0060a885218ca319d382b
https://git.kernel.org/stable/c/4f0f4b09a95ef602fbdae948326beadd9c20eab3
https://git.kernel.org/stable/c/6e78792d8ce1fa3561713860ee8086901dde4f99
https://git.kernel.org/stable/c/82fdbf49b9f7528c82bf608cfa9710e5f81a198c
https://git.kernel.org/stable/c/8f735d64382dcf162f4276d6699d03ad2f859c0b

History

Sep 20, 2026 4:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-399

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the overhead, the size-table data (u16), and size_log (up to STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len() to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as DRR and ETS replenish one quantum per loop iteration; with a tiny quantum (1) they spin billions of times under the qdisc lock, producing a soft lockup / RCU stall as illustrated by vega@nebusec.ai. Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table amplification cannot drive deficit schedulers into an unbounded loop. A legitimate size table (e.g. qfq's overhead 999999999, which is handled by dropping) is still accepted. Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above any legitimate single-skb wire length: the largest current skb->len is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax) amplifies that to ~578 KB, both comfortably below 1 MiB. At the same time, 1 MiB bounds the deficit refill loop to ~1M iterations per packet with quantum=1, which completes in a few milliseconds well under the demonstrated softlockup threshold (~10^9 iterations). Conditions to recreate the bug: - CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y). - Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]). - Add a class with a tiny quantum of 1 and send one small packet; the deficit loop spins billions of times under the qdisc lock and trips the softlockup detector (panic with kernel.softlockup_panic=1). - Reachable as root or from an unprivileged user in a fresh user+net namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.
Title		net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0bc5a6280a132a2170c6fa742436e01b635f02de https://git.kernel.org/stable/c/16d21a27df3f50b7251c9388fc5a7ab22703b469 https://git.kernel.org/stable/c/1a5c26e586481bc82abc19ac92c3d9f10518f525 https://git.kernel.org/stable/c/448c34421b38ec7c93a0060a885218ca319d382b https://git.kernel.org/stable/c/4f0f4b09a95ef602fbdae948326beadd9c20eab3 https://git.kernel.org/stable/c/6e78792d8ce1fa3561713860ee8086901dde4f99 https://git.kernel.org/stable/c/82fdbf49b9f7528c82bf608cfa9710e5f81a198c https://git.kernel.org/stable/c/8f735d64382dcf162f4276d6699d03ad2f859c0b