CVE-2026-98009

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-98009
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98009.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-98009
Downstream
Related
Published
2026-09-25T10:23:34Z
Modified
2026-10-09T17:27:00Z
Summary
net/sched: ets: clamp quantum in parse and fallback paths
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: clamp quantum in parse and fallback paths

ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.

Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path.

Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).

tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98009.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33
Fixed
440b66cc7b56ea38e9b878ae88da91992efaa4c4
Fixed
4ef8664eafafc8db68a1d52601f17dc008a223b7
Fixed
8b8d782c3b96376217087767dcf662cd3d25f226
Fixed
226d2702e74a570f5bfae6115b4706da4b94e5cf
Fixed
99ae477b892e203a37985ebc56f0063e072f7f4b
Fixed
8f80b113dea0bed3c1a31a4224b72775cd9ec52d
Fixed
de22c30ec5598aca8797f02082d2ee1358dfa3ff
Fixed
1c38487f46b243bfeefec0c0c86023a3904f2214

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98009.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98009.json"