https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:13:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-98009 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: ets: clamp quantum in parse and fallback paths</p> <p>ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.</p> <p>Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1&lt;&lt;20], not just the fallback path.</p> <p>Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).</p> <p>tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: ets: clamp quantum in parse and fallback paths</p> <p>ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.</p> <p>Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1&lt;&lt;20], not just the fallback path.</p> <p>Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).</p> <p>tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1</p> https://vulnerability.circl.lu/vuln/cve-2026-98009