CVE-2026-90058 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the overhead, the size-table data (u16), and size_log (up to STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len() to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as DRR and ETS replenish one quantum per loop iteration; with a tiny quantum (1) they spin billions of times under the qdisc lock, producing a soft lockup / RCU stall as illustrated by [email protected].
Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table amplification cannot drive deficit schedulers into an unbounded loop. A legitimate size table (e.g. qfq's overhead 999999999, which is handled by dropping) is still accepted.
Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above any legitimate single-skb wire length: the largest current skb->len is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax) amplifies that to ~578 KB, both comfortably below 1 MiB. At the same time, 1 MiB bounds the deficit refill loop to ~1M iterations per packet with quantum=1, which completes in a few milliseconds well under the demonstrated softlockup threshold (~10^9 iterations).
Conditions to recreate the bug: - CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y). - Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]).
- Add a class with a tiny quantum of 1 and send one small packet; the deficit loop spins billions of times under the qdisc lock and trips the softlockup detector (panic with kernel.softlockup_panic=1). - Reachable as root or from an unprivileged user in a fresh user+net namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel networking subsystem contains a critical vulnerability within the traffic control scheduling logic, specifically affecting per-flow deficit schedulers such as Deficit Round Robin and Earliest Deadline First. This flaw arises from an insufficient validation of user-supplied size table parameters passed to qdisc_get_stab(). When processing these tables, the function __qdisc_calculate_pkt_len() applies amplification factors including overhead data stored in unsigned 16-bit integers and a logarithmic scaling factor known as size_log. Because there was no upper bound on the resulting packet length calculation, an attacker could craft a malicious stability table that causes qdisc_pkt_len to return values approaching one gigabyte for standard socket buffers. This discrepancy between expected packet sizes and calculated lengths creates a severe resource exhaustion condition when processed by deficit-based scheduling algorithms.
The operational impact of this vulnerability is a denial of service manifested as a kernel soft lockup or RCU stall. Deficit schedulers operate by replenishing a quantum value in loop iterations proportional to the packet length divided by a configured quantum size. With an artificially inflated qdisc_pkt_len and a minimal quantum setting, such as one, the scheduler enters an infinite-appearing loop that spins billions of times while holding the queue discipline lock. This behavior effectively freezes the network processing thread for the affected interface or namespace, preventing legitimate traffic from being scheduled and potentially causing system-wide instability if the softlockup detector triggers a panic condition. The vulnerability is reachable by users with CAP_NET_ADMIN privileges within their own user and network namespaces, allowing unprivileged local attackers to exploit this flaw without requiring root access on the host itself.
From a technical remediation perspective, the kernel developers addressed this issue by introducing a hard cap defined as QDISC_PKT_LEN_MAX set to one megabyte via bitwise shift operations. This limit is strategically chosen because it exceeds any legitimate single socket buffer length, including those affected by Generic Segmentation Offload limits or ATM-style cell tax amplifications, which typically remain well below the new threshold. By capping the calculated packet length at this value, the maximum number of iterations in a deficit refill loop is bounded to approximately one million cycles per packet even with the smallest quantum setting. This ensures that any processing delay remains within milliseconds and does not trigger kernel watchdog timers or softlockup detectors, thereby preserving system stability while maintaining support for legitimate large-packet configurations like those used by Fair Queuing algorithms.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attack vector involves manipulating configuration parameters through netlink sockets, a technique often associated with privilege escalation or local denial-of-service scenarios in Linux kernel exploitation contexts. Mitigation strategies involve applying the upstream kernel patch that enforces the QDISC_PKT_LEN_MAX boundary check during packet length calculation. System administrators should ensure their kernels are updated to include this fix and monitor for unusual network scheduling configurations within containerized environments where users possess administrative capabilities over network namespaces. Regular auditing of netlink attribute validation in networking subsystems remains essential to prevent similar amplification-based denial-of-service vulnerabilities from being introduced or exploited in future kernel versions.