CVE-2026-98009

Overview

CVE-2026-98009 is a Linux kernel vulnerability affecting the ETS traffic control qdisc when CONFIG_NET_SCH_ETS is enabled. A crafted quantum table can cause the deficit‑refill loop to spin under the qdisc lock, leading to high CPU usage or a kernel lockup. The flaw is mitigated by clamping quantum values to a safe range in ets_quantum_parse.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock. Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path. Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1

Impact

The vulnerability can cause denial‑of‑service by exhausting CPU resources or locking the kernel, impacting system availability. Network administrators and cloud operators who configure ETS qdiscs are directly affected. The issue does not expose data or allow privilege escalation.

Remediation

Apply the kernel patch that clamps ETS quantum values to [256, 1<<20] in ets_quantum_parse. Alternatively, disable ETS qdisc support (CONFIG_NET_SCH_ETS=n) or avoid using CAP_NET_ADMIN privileges for untrusted users. Ensure the system runs a kernel version that includes the fix.

Risk context

The CVSS v3 score of 5.5 indicates medium severity; no EPSS data is available. The risk is moderate and should be addressed promptly, especially on systems that enable ETS qdiscs.

Affected products

• Linux kernel