net/sched: fq_pie: clamp quantum in change path (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp quantum in change path fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0
References
- https://git.kernel.org/stable/c/ff4f3a0f3abd2ded467931d7da7984a68a768e0b
- https://git.kernel.org/stable/c/749aaebc1eb92ce2f38fd3caf68a2f99686d84ef
- https://git.kernel.org/stable/c/8fd98e56c41f79278eeb67512c28d7abc175bcf4
- https://git.kernel.org/stable/c/215df1e953ae72a09d425ec188e054058ae23dc9
- https://git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa
- https://git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415
- https://git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61
- https://git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970
European references
- ENISA EUVD · EUVD-2026-86666
- GCVE · GCVE-0-2026-98013
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < ff4f3a0f3abd2ded467931d7da7984a68a768e0b ; affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < 749aaebc1eb92ce2f38fd3caf68a2f99686d84ef ; affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < 8fd98e56c41f79278eeb67512c28d7abc175bcf4 ; affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < 215df1e953ae72a09d425ec188e054058ae23dc9 ; affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < f90fe65b977e7aa9eb302230a09eb18f8c32ceaa ; affected ec97ecf1ebe485a17cd8395a5f35e6b80b57665a < c11e3a39807eb5a200445ae9082843ab86800415 |
| Linux · Linux | affected 5.6 ; unaffected 0 < 5.6 ; unaffected 5.10.271 ≤ 5.10.* ; unaffected 5.15.222 ≤ 5.15.* ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |