Executive brief
The Linux kernel's Fair Queue Packet Intelligent Enqueueing (FQ_PIE) network packet scheduler contains an integer overflow vulnerability in its initialization routine. An attacker with network administration privileges can configure a network device with an extremely large MTU value to trigger the overflow, causing the kernel to enter an infinite loop and become unresponsive. This results in system hang and denial of service without requiring administrative access outside a user namespace.
Technical details
The vulnerability is a signed integer overflow in the fq_pie_init() function within net/sched/sch_fq_pie.c. The function sets q->quantum to psched_mtu(qdisc_dev(sch)) without clamping the value. On a device with a huge MTU (e.g., a dummy device configured to accept MTU 2147483634), psched_mtu() returns 0x80000000, which when stored in the signed flow->deficit variable causes an overflow to INT_MIN. This overflow triggers an infinite loop in fq_pie_qdisc_dequeue(), resulting in a soft lockup. The attack vector requires CAP_NET_ADMIN capability, but can be executed within an unprivileged user namespace. The fix clamps the quantum value to the range [256, 2^20], matching the existing fq_pie_policy bounds and preventing the overflow condition.
Affected products
- Linux Linux Kernel Multiple kernel versions (all versions with fq_pie scheduler support prior to patch commit c86cd7ed0b0e44779a3d1683f03e4353baf4bdc9)
Timeline
- 2026-09-17: disclosed: CVE-2026-90074 published
- 2026-08-22: patched: Fix committed by Jamal Hadi Salim