CVE-2026-98011

Overview

CVE-2026-98011 is a Linux kernel denial-of-service flaw in the HHF traffic-control qdisc. An unclamped quantum value can cause a long deficit-refill loop under the qdisc lock, leading to a soft lockup. It matters because local users with network-admin privileges can affect kernel stability on systems where the HHF scheduler is enabled.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow. Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0

Impact

Confidentiality is not expected to be affected. Integrity is not expected to be directly affected. Availability is impacted by a potential soft lockup or denial of service. Local users or workloads with CAP_NET_ADMIN on hosts using the HHF qdisc are the primary affected population.

Remediation

Apply the vendor kernel update that clamps the HHF quantum in the change and init paths. If the HHF qdisc is not required, disable CONFIG_NET_SCH_HHF or remove the module where supported. Restrict CAP_NET_ADMIN and network-namespace creation to trusted administrators. Monitor and audit traffic-control configuration changes for unexpected HHF qdisc settings.

Risk context

The reported severity is medium with CVSS v3 5.5 and no EPSS score is provided. Urgency is moderate: prioritize patching where untrusted local users can configure qdiscs and the HHF scheduler is enabled, otherwise include in routine kernel maintenance.

Affected products

• Linux kernel
• Linux net/sched HHF qdisc
• Distributions with CONFIG_NET_SCH_HHF enabled