Executive brief
The Linux kernel's network packet scheduling (qdisc) component has a vulnerability in how it calculates packet lengths when using a size table. An attacker can craft a malicious size table that causes certain queue disciplines (DRR and ETS) to spin in an infinite loop, consuming CPU and causing the system to become unresponsive (soft lockup). This affects systems using specific network scheduling configurations and is exploitable by root users or unprivileged users in isolated namespace environments.
Technical details
The vulnerability exists in the qdisc_get_stab() and __qdisc_calculate_pkt_len() functions, which accept user-supplied size table parameters without properly bounding the resulting packet length calculation. A crafted size table can amplify qdisc_pkt_len() to ~1 GiB. Per-flow deficit schedulers (DRR and ETS) refill their quantum in a loop iteration; with a tiny quantum value and an inflated packet length, the loop iterates billions of times under the qdisc lock, causing a soft lockup or RCU stall. The fix caps qdisc_pkt_len() to QDISC_PKT_LEN_MAX (1 MiB) to bound the deficit refill loop iterations. Exploitation requires CONFIG_NET_SCHED with CONFIG_NET_SCH_DRR or CONFIG_NET_SCH_ETS enabled, and either root privileges or CAP_NET_ADMIN in an unprivileged namespace.
Affected products
- Linux Linux kernel affected versions unspecified in advisory
Timeline
- 2026-09-17: disclosed
- patched: fix implemented by capping qdisc_pkt_len to QDISC_PKT_LEN_MAX