Executive brief
The Linux kernel's HTB (Hierarchical Token Bucket) network traffic scheduler contains a flaw that allows unprivileged users to trigger an infinite loop during packet classification. When configured with certain filter rules, processing a single packet can lock up the system, causing a denial of service without requiring elevated privileges.
Technical details
The vulnerability exists in the htb_classify() function within the kernel's qdisc scheduler (net/sched/sch_htb). The function traverses filter chains on inner classes without bounding the number of hops, and malicious filter rules can create cycles (e.g., a filter pointing to itself or to another class that eventually points back). When htb_classify() follows these cycles, it enters an infinite loop with the qdisc lock held and bottom-half interrupts disabled, leading to a soft lockup or kernel panic. The attack is reachable from unprivileged users via container namespaces (unshare -Urn with CAP_NET_ADMIN). The fix introduces a hop counter limited to TC_HTB_MAXDEPTH and drops packets that exceed this bound, preventing legitimate traffic (which descends monotonically in class levels) while blocking the attack.
Affected products
- Linux Linux kernel before fix (CVE-2026-90053)
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix applied to kernel net/sched/sch_htb