CVE-2026-98013

Overview

The Linux kernel fq_pie qdisc change path accepts an unbounded quantum value from userspace. A crafted qdisc configuration can cause a very long deficit-refill loop under the qdisc lock, leading to a soft lockup and denial of service. This matters for systems where privileged users can configure network qdiscs and fq_pie is enabled.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp quantum in change path fq_pie_change() accepts any quantum value from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service). Add max(256U, ...) matching fq_codel_change(). Conditions to recreate the bug: CONFIG_NET_SCH_FQ_PIE=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root fq_pie tc qdisc change dev dummy0 root fq_pie quantum 1 stab data 32768 size_log 15 cell_log 0

Impact

The primary impact is availability, with a potential soft lockup or system hang. Confidentiality and integrity impacts are not indicated. It affects hosts where fq_pie is enabled and an actor can configure qdiscs with CAP_NET_ADMIN or equivalent namespace privileges. The issue is local and requires privileged network configuration rights.

Remediation

Apply the vendor kernel update that clamps the fq_pie quantum value in the change path. If fq_pie is not required, disable CONFIG_NET_SCH_FQ_PIE or avoid loading the module. Restrict CAP_NET_ADMIN and tc/qdisc configuration to trusted administrators. Monitor and audit qdisc configuration changes on affected hosts.

Risk context

Severity is medium with CVSS v3 5.5, and no EPSS score is provided. Urgency is moderate, especially for systems where untrusted users can configure qdiscs or where fq_pie is enabled in production. Patching should be prioritized according to normal kernel update cadence and exposure to privileged local users.

Affected products

• Linux kernel
• Linux kernel net/sched fq_pie
• Distributions with CONFIG_NET_SCH_FQ_PIE enabled