CVE-2026-90074 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq_pie: clamp default quantum to avoid signed overflow
fq_pie_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which overflows the signed flow->deficit to INT_MIN in fq_pie_qdisc_dequeue(), causing an infinite loop and soft lockup. Emulate fq_pie_policy which is already bounded to [1, 1 << 20]; clamp the default to [256, 1 << 20].
256 matches fq_codel's floor and is a sane minimum for a DRR quantum.
Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel networking subsystem contains a critical vulnerability within the fq_pie queueing discipline implementation that can lead to system instability and denial of service conditions. This flaw originates from an improper handling of packet size parameters during initialization, specifically involving the calculation of the quantum value used for fair queuing operations. The function fq_pie_init is responsible for setting the initial quantum value based on the Maximum Transmission Unit (MTU) of the associated network device by calling psched_mtu. However, this implementation fails to validate or clamp the resulting MTU value before assigning it to the q->quantum field. This lack of bounds checking creates a scenario where excessively large MTU values can result in integer overflow conditions that compromise the integrity of subsequent scheduling calculations.
The technical root cause lies in how psched_mtu processes device parameters and how those results interact with signed 32-bit integers used throughout the fq_pie algorithm. When a network device is configured with an extremely high MTU, such as a dummy interface accepting values up to 2147483634 bytes due to having max_mtu set to zero, psched_mtu returns a value of 0x80000000. This hexadecimal value corresponds to the minimum negative number representable in a signed 32-bit integer format. When this oversized quantum is subsequently used in fq_pie_qdisc_dequeue, it causes an overflow when interacting with flow->deficit variables. Specifically, the arithmetic operations involved result in deficit values wrapping around to INT_MIN, which fundamentally breaks the loop termination logic within the dequeue routine.
The operational impact of this vulnerability is severe, manifesting as a soft lockup or infinite loop within the kernel network stack. Because the fq_pie_qdisc_dequeue function relies on decrementing the deficit counter until it becomes non-negative to proceed with packet transmission, an initial value that causes overflow into negative territory prevents the condition from ever being met naturally under normal traffic patterns. This results in a CPU-intensive busy-wait state where one or more kernel threads are permanently occupied processing packets for this specific queue discipline. Such behavior effectively denies service to other network operations and can lead to system-wide instability, particularly if multiple interfaces trigger this condition simultaneously. The vulnerability requires CAP_NET_ADMIN privileges within a user namespace to exploit, meaning it is primarily relevant in containerized environments where users have elevated networking capabilities but are otherwise restricted by security boundaries.
From a standards perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write if the overflow leads to memory corruption, though here it primarily causes logical errors leading to denial of service. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Local Privilege Escalation via Denial of Service (T1496) or potentially Resource Hijacking depending on how the system responds to the sustained CPU load caused by the soft lockup. The exploitation vector is local and requires initial access with specific administrative capabilities within a namespace context, making it particularly dangerous in multi-tenant cloud environments where improper configuration of dummy interfaces could be leveraged for disruptive effects against shared infrastructure.
To mitigate this vulnerability, developers have implemented clamping logic that restricts the default quantum value to a safe range between 256 and one megabyte (1 << 20). This approach mirrors existing policies found in fq_codel implementations, ensuring consistency across different queueing disciplines within the kernel. The lower bound of 256 bytes is chosen because it matches the floor used by fq_codel and represents a sane minimum for Deficit Round Robin quantum sizes, preventing excessively small packets from causing excessive scheduling overhead while avoiding the upper bounds that lead to integer overflow. System administrators should ensure their Linux kernels are updated with patches addressing this specific issue in net/sched/fq_pie.c. Additionally, when configuring network interfaces, especially dummy or virtual devices, it is prudent to explicitly set MTU values within standard operational ranges rather than relying on default maximums that may exceed safe computational limits for kernel scheduling algorithms.