Executive brief
The Linux kernel's Stochastic Fairness Queueing (SFQ) network packet scheduler can be triggered to enter an infinite loop under certain conditions. An attacker with administrative privileges in a container or user namespace can create a network device with a large Maximum Transmission Unit (MTU) value that causes integer arithmetic to overflow, causing the kernel to spin indefinitely and hang the system. This leads to a denial of service affecting network packet processing on the affected host.
Technical details
The vulnerability is a signed integer overflow in the sfq_init() function within net/sched/sch_sfq.c. When initializing the SFQ qdisc, the code sets q->quantum based on psched_mtu(qdisc_dev(sch)) without bounds checking. A device configured with a sufficiently large MTU (e.g., 2147483634 on a dummy device with max_mtu == 0) causes psched_mtu() to return 0x80000000, which when used as a signed 32-bit value equals INT_MIN. Subsequent arithmetic operations with INT_MIN (INT_MIN + INT_MIN) toggle between INT_MIN and 0, causing sfq_dequeue() to spin indefinitely under the qdisc lock. The fix clamps the quantum value to the range [256, 1<<20] to prevent overflow. Exploitation requires CAP_NET_ADMIN capability, typically available only to privileged users or within a user namespace with elevated capabilities.
Affected products
- Linux Linux kernel 2.6.12 and later (prior to patch applied)
Timeline
- 2026-09-17: disclosed
- 2026-08-22: patched: Upstream patch commit 816e90057ab1879562a5b7cc688e35bb9027ae97
- 2026-09-14: other: Patch merged into stable kernel trees