CVE-2026-98010 net/sched: drr: clamp quantum in change class
A local attacker with CAP_NET_ADMIN can cause a denial of service in the Linux kernel DRR scheduler by triggering an infinite loop via crafted quantum values.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98010?
CVE-2026-98010 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: drr: clamp quantum in change class
drr_change_class() rejects explicit quantum==0 but falls back to psched_mtu() with no floor. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless device) makes the deficit-refill loop spin under the qdisc lock.
Add clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the fallback path. The explicit-zero reject is preserved.
Conditions to recreate the bug: CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root drr tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1
Which versions are affected by CVE-2026-98010?
How do I fix CVE-2026-98010?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98010 being exploited?
There is no known exploitation of CVE-2026-98010 in the wild and no public exploit code.
Sources
Also known as AZL-104258, BELL-CVE-2026-98010, DEBIAN-CVE-2026-98010, GHSA-m5hh-pp2g-6f3p, UBUNTU-CVE-2026-98010.