Executive brief
The Linux kernel's fair queuing (FQ) network packet scheduler contains an integer overflow vulnerability in its initialization code. When a network device is configured with an extremely large MTU (Maximum Transmission Unit), arithmetic operations wrap around to zero, causing the scheduler to enter an infinite loop under kernel lock. This results in a system hang that can only be triggered by administrators with network configuration privileges.
Technical details
The vulnerability exists in net/sched/sch_fq.c in the fq_init() function, which computes quantum and initial_quantum values by multiplying psched_mtu() by 2 and 10 respectively, without overflow protection. When psched_mtu() returns 0x80000000 (from a device with an excessively large MTU such as a dummy device accepting MTU 2147483634), the 32-bit multiplications wrap to zero. This causes q->quantum to become 0, which leads to the fq_dequeue() credit-refill loop adding 0 indefinitely and looping forever under the qdisc (queueing discipline) lock, triggering a soft lockup. The attack requires CAP_NET_ADMIN capability in a user namespace. The patch clamps psched_mtu() to the range [1, 1 << 20] before multiplication and caps results at 1 << 20 to prevent wrapping.
Affected products
- Linux Linux kernel Multiple versions (patch available for 2.6.11 through 7.2 stable series)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-08-25: patched: Patch committed to stable kernel
- 2026-08-22: other: Patch authored