CVE-2026-98012

Overview

The Linux kernel's SFQ traffic-control qdisc change path failed to clamp the quantum value, accepting values beyond intended limits. This can allow a local user with CAP_NET_ADMIN to configure SFQ in a way that may cause kernel memory corruption or denial of service. It matters because traffic-control configuration can be available to unprivileged users in user namespaces.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq_change() accepts any non-negative quantum (only rejects (int)ctl->quantum 1<<20 with -EINVAL, matching fq_codel_change() and the init clamp. Conditions to recreate the bug: CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root sfq tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

Impact

Confidentiality and integrity are not the primary concern; the main risk is availability through kernel instability. A local actor with CAP_NET_ADMIN in a user or network namespace can trigger the issue by changing an SFQ qdisc. Systems that expose traffic-control configuration to untrusted local users or containers are most at risk. The issue is local and requires kernel support for SFQ.

Remediation

Apply vendor kernel updates that clamp SFQ quantum in the change path. If SFQ is not required, disable CONFIG_NET_SCH_SFQ or remove SFQ qdisc support. Restrict CAP_NET_ADMIN and prevent untrusted users or containers from creating or changing qdiscs. Audit tc qdisc configurations and alert on SFQ changes.

Risk context

CVSS v3 5.5 (medium) is provided, with no EPSS score. Treat this as moderate urgency for systems where untrusted local users can configure traffic control. Prioritize patching if SFQ is enabled and local privilege boundaries are weak.

Affected products

• Linux kernel
• net/sched SFQ
• traffic control (tc)