Executive brief
The Linux kernel's network packet queue management (used in gred, bfifo, and plug queue disciplines) uses 32-bit arithmetic to track queue depth, which wraps around after 4 GiB. An attacker with root access can exploit this wraparound to bypass queue admission checks, causing the kernel to accept unlimited packets and trigger out-of-memory conditions leading to system crash.
Technical details
The vulnerability is an integer overflow in the network queue discipline (qdisc) admission logic. The functions gred_enqueue(), bfifo_enqueue(), and plug_enqueue() check if (backlog + packet_length <= limit) before admitting packets. Both backlog (u32) and packet length (unsigned int) are 32-bit, so their sum wraps at 2^32. Once true backlog exceeds 4 GiB, the wrapped sum becomes small, admission checks pass incorrectly, and the queue grows unbounded. The fix promotes backlog and intermediate calculations to u64 to prevent wraparound. Exploitation requires root privileges to configure a qdisc with limit near 4 GiB and inject over 4 GiB of queued traffic (via packet size inflation or sustained high-rate traffic), resulting in kernel OOM and denial of service.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 6.x and beyond (affected by backlog wraparound in GRED, BFIFO, and plug qdisc since a3eb95f891d6)
Timeline
- 2026-08-18: disclosed: Fix authored by Jamal Hadi Salim
- 2026-08-20: patched: Upstream fix commit 4c660ee8c809637909f4f7eb1017f7b9401c75c4 merged
- 2026-09-17: advisory: CVE-2026-90109 published