Executive brief
The Linux kernel's fair queue CoDel (fq_codel) packet scheduler can enter an infinite loop on systems with extremely large network device MTU (Maximum Transmission Unit) values, causing the system to become unresponsive. An attacker with network administrator privileges in a container or user namespace can trigger this condition to cause a denial of service attack on affected systems.
Technical details
The fq_codel packet scheduler in the Linux kernel failed to validate MTU values when initializing queue parameters. Specifically, fq_codel_init() passed an unclamped MTU value (via psched_mtu()) to set both q->quantum and q->cparams.mtu. On a device with a huge MTU (e.g. 2147483634), psched_mtu() returns 0x80000000, which overflows the signed flow->deficit variable to INT_MIN in fq_codel_dequeue(), causing an infinite loop and soft lockup. Additionally, this large unclamped MTU value disables CoDel's congestion control mechanism entirely. The vulnerability requires CAP_NET_ADMIN capability, limiting exploitation to privileged users or compromised containers. The fix clamps the MTU value to the range [256, FQ_CODEL_QUANTUM_MAX] during initialization.
Affected products
- Linux Linux Kernel All versions with fq_codel scheduler (kernel 3.5+)
Timeline
- 2026-09-17: disclosed: CVE-2026-90075 published
- 2026-09-14: patched: Fix included in stable kernel releases