CVE-2026-98010

Overview

This CVE affects the Linux kernel's DRR qdisc, allowing a crafted quantum value to cause a spinlock under the qdisc lock, potentially leading to denial of service. The issue arises when quantum is set to 1 or zero, causing the deficit-refill loop to spin. It matters because it can degrade network performance or cause kernel stalls on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock. Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved. Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1

Impact

Confidentiality: none. Integrity: none. Availability: high due to potential denial of service. Impacted parties: system administrators, network operators, and any services running on affected Linux kernels with CONFIG_NET_SCH_DRR enabled.

Remediation

Apply the kernel patch that clamps quantum to 256-1<<20 and rejects zero values. Update to a kernel version where CVE-2026-98010 is fixed. Disable CONFIG_NET_SCH_DRR if not needed, or remove the drr qdisc from interfaces. Ensure CAP_NET_ADMIN privileges are restricted.

Risk context

Medium severity; no EPSS data. Defenders should assess whether the DRR qdisc is used; if so, patch promptly.

Affected products

• Linux kernel