CVE-2026-90073 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
hhf_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) with no overflow check. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes weight * quantum overflow the signed deficit in hhf_dequeue(), spinning forever.
Clamp q->quantum before hhf_change() so both the opt and !opt paths see a sane quantum. Without this, bare "tc qdisc add ... hhf" succeeds with a clamped quantum but "tc qdisc add ... hhf limit 1000" (any option present) fails with -EINVAL because hhf_change() re-validates the unclamped default (sch_hhf.c:559). 256 matches fq_codel's floor and is a sane minimum for a DRR quantum.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel contains a critical integer overflow vulnerability within the Hierarchical Hybrid Fair Queuing (HHF) network scheduler implementation, specifically located in the net/sched/hhf.c module. This flaw arises from an insufficient validation of input parameters during the initialization and configuration phases of the qdisc structure. The core issue is that hhf_init() assigns a value to the quantum field based on psched_mtu(qdisc_dev(sch)) without performing any bounds checking or overflow protection. When this initial assignment occurs, it relies entirely on the Maximum Transmission Unit (MTU) configured for the associated network device. If an attacker can configure a network interface with an excessively large MTU value, such as 2147483634 bytes often found in dummy devices where max_mtu is set to zero, the resulting quantum calculation exceeds the limits of signed integer arithmetic used internally by the scheduler logic.
The operational impact of this vulnerability manifests during packet dequeue operations within hhf_dequeue(). The HHF algorithm utilizes a deficit round-robin mechanism that tracks deficits using signed integers. When the quantum value derived from an oversized MTU is multiplied by weight, it causes an integer overflow in the calculation of the weighted quantum. This overflow corrupts the state of the scheduler's internal accounting variables, specifically causing the deficit to become negative or otherwise malformed. Consequently, the dequeue loop enters a condition where it cannot properly advance through the queue entries because the mathematical conditions for moving packets are never met due to the corrupted arithmetic states. This results in an infinite spin loop within the kernel space, effectively hanging the CPU core responsible for processing network traffic on that interface and leading to a denial of service condition for all network operations dependent on that scheduler instance.
From a security perspective, this vulnerability is classified under CWE-190 Integer Overflow or Wraparound, as it involves arithmetic operations exceeding the capacity of the data type used to store the result. It also aligns with CWE-20 Improper Input Validation, since the system fails to validate the MTU value before using it in critical calculations. In terms of attack vectors and tactics, this flaw is relevant to MITRE ATT&CK technique T1496 Resource Hijacking, specifically subtechnique T1496.001 CPU Consumption due to Infinite Loop or Spinloop. An attacker with the necessary privileges can exploit this logic error to consume system resources indefinitely, disrupting service availability without needing to crash the entire kernel, which makes detection and mitigation more challenging for automated systems that monitor for process termination rather than resource exhaustion patterns.
The conditions required to reproduce and exploit this vulnerability involve a user possessing CAP_NET_ADMIN capabilities within a Linux user namespace. This privilege level allows the creation of network namespaces and the configuration of qdiscs on virtual interfaces such as dummy devices. By creating a dummy interface with an artificially inflated MTU value that triggers the psched_mtu overflow, an attacker can trigger hhf_init() to set an invalid quantum. Subsequently, attempting to add or modify the HHF qdisc using tc commands will either succeed in setting up the flawed configuration if no options are provided, or fail with -EINVAL due to re-validation logic in hhf_change(). However, even when it fails during change operations, the initial setup phase may have already corrupted internal states depending on the exact sequence of calls. The fix involves clamping the quantum value before passing it to hhf_change(), ensuring that both paths where options are present and absent receive a sane default. A recommended safe minimum for a Deficit Round Robin (DRR) quantum is 256 bytes, which matches the floor used by fq_codel and prevents overflow while maintaining reasonable scheduling granularity.
Mitigation strategies should focus on applying kernel patches that enforce strict bounds checking on MTU values before they are converted into scheduler parameters. System administrators can mitigate this risk in the interim by restricting the use of dummy interfaces with high max_mtu settings to trusted users only, ensuring that CAP_NET_ADMIN is not granted unnecessarily within untrusted user namespaces. Additionally, network security policies should monitor for unusual CPU usage spikes on hosts running kernel versions susceptible to this flaw, particularly those utilizing HHF qdiscs in their traffic shaping configurations. Regular updates of the Linux kernel are essential to address these low-level arithmetic vulnerabilities that can lead to significant availability impacts through resource exhaustion attacks.