CVE-2026-98009 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: clamp quantum in parse and fallback paths
ets_qdisc_change() falls back to psched_mtu() with no floor for bands without an explicit quantum. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the deficit-refill loop spin under the qdisc lock.
Move the floor into ets_quantum_parse() so explicitly configured quanta are also clamped to [256, 1<<20], not just the fallback path.
Conditions to recreate the bug: CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel networking subsystem contains a critical logic flaw within the Enhanced Transmission Selection (ETS) queueing discipline implementation, specifically in how quantum values are parsed and applied to traffic control classes. This vulnerability arises from an insufficient validation of input parameters provided by userspace applications when configuring network interfaces via the tc utility. The ETS qdisc allows administrators to define bandwidth allocation strategies for different priority bands, where each band is assigned a specific quantum value that determines its share of transmission opportunities. However, the code path responsible for parsing these quanta and handling fallback scenarios fails to enforce appropriate lower bounds on the resulting values. This oversight creates a scenario where malformed or crafted input can lead to extreme computational behavior within the kernel's packet scheduling logic.
The technical root cause lies in the ets_qdisc_change function which manages updates to ETS configurations. When processing bands that do not have an explicit quantum defined, the system falls back to using psched_mtu as a default value. In environments utilizing headerless devices or specific network configurations where psched_mtu evaluates to zero, this results in a division by zero or near-zero arithmetic operation within the deficit-refill loop. This loop is responsible for tracking how much data each band has transmitted and determining when it can transmit again. With an effectively infinite quantum due to the lack of clamping, qdisc_pkt_len can reach approximately two gigabytes before being processed correctly. Consequently, the scheduler enters a tight spin under the qdisc lock because the deficit calculation never completes or resets properly. This behavior effectively traps the CPU core executing this logic in an unyielding loop, preventing other tasks from acquiring the same lock and leading to significant system instability.
From an operational impact perspective, this vulnerability constitutes a denial of service condition that can be triggered by any local user possessing CAP_NET_ADMIN capabilities within their network namespace. The requirement for administrative privileges means it is not remotely exploitable over the network but poses a severe threat in multi-tenant environments or systems where untrusted users are granted limited networking control via containerization technologies like Docker or Kubernetes namespaces using commands such as unshare -Urn. An attacker can exploit this by crafting specific tc qdisc add commands that set quanta to minimal values, forcing the kernel into the problematic state described above. The result is a hung process and potentially an entire system freeze if multiple cores are affected or if critical network services depend on the locked scheduler resources. This aligns with CWE-400 Uncontrolled Resource Consumption, as the flaw allows a single actor to exhaust CPU cycles indefinitely through improper input validation leading to infinite loops.
The mitigation strategy implemented in the kernel update involves moving the quantum clamping logic directly into the ets_quantum_parse function. This ensures that both explicitly configured quanta and those derived from fallback paths are strictly bounded within a safe range, specifically between 256 bytes and one megabyte (1<<20). By enforcing these limits at the point of parsing rather than relying on downstream assumptions about psched_mtu behavior, the kernel prevents the arithmetic anomalies that lead to the spin loop. This fix addresses both the immediate symptom and the underlying design weakness in input validation. Administrators should ensure their systems are updated with this patch applied. For environments where updating is not immediately feasible, restricting CAP_NET_ADMIN privileges or disabling ETS qdisc configuration for untrusted users serves as a temporary compensating control to prevent exploitation of this resource exhaustion flaw.