Executive brief
The Linux kernel's HHF (Heavy-Hitter Filter) network packet scheduler fails to validate the quantum parameter when initialized with unusually large network device MTUs. An attacker with administrative privileges can create a device with an oversized MTU that causes an integer overflow, causing the scheduler to enter an infinite loop and hang the system, denying service to legitimate network traffic.
Technical details
The vulnerability is an integer overflow flaw in the HHF qdisc initialization code (net/sched/sch_hhf.c). The hhf_init() function sets q->quantum = psched_mtu(qdisc_dev(sch)) without checking for overflow. When a device with a very large MTU (e.g., a dummy device accepting MTU 2147483634) is configured, the weight * quantum multiplication in hhf_dequeue() overflows a signed 32-bit integer, causing the deficit calculation to wrap into the sign bit and resulting in an infinite loop. The attack requires CAP_NET_ADMIN capability, typically available to root or in a privileged user namespace. The fix clamps q->quantum to a minimum safe value (256) before hhf_change() is called, ensuring both configuration paths validate against a sane default.
Affected products
- Linux Linux kernel multiple versions (patch backported to stable series linux-2.6.11.y through linux-7.2.y and rolling stable)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-08-22: patched: Upstream commit 2164b512b97bb053e8ce4d6e95576f11bed6a005
- 2026-09-14: other: Backported to stable kernel series by Greg Kroah-Hartman