{"id":"CVE-2026-90050","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq: clamp quantum and initial_quantum in change path\n\nThe fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and\nTCA_FQ_INITIAL_QUANTUM up to INT_MAX, whi…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq: clamp quantum and initial_quantum in change path\n\nThe fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and\nTCA_FQ_INITIAL_QUANTUM up to INT_MAX, whi…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d16dac3925be95ad46e986d4b139c9898b6e227f < a27498d34c3f429fb6db3aa609569f8154afa175","Linux >= f6b3e3848a5fca63438984acd6d9eceac80814c1 < 798283cd0fe7ba997f67e5a917f14ab40afa8d9f","Linux >= e35acd56f244d94355f9ab237c2ecc8fba5e6f04 < 72e9387884554f47b03bfd40fb8b2bf52789c68d","Linux >= 709f34f7c28dc4dd6c40343d101850f11e172312 < 094cc07f98dfe70a34e2a1923af17fd29b8cf622","Linux 7.3-rc1"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:16:53.363","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90050","references":[{"url":"https://git.kernel.org/stable/c/094cc07f98dfe70a34e2a1923af17fd29b8cf622","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72e9387884554f47b03bfd40fb8b2bf52789c68d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/798283cd0fe7ba997f67e5a917f14ab40afa8d9f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a27498d34c3f429fb6db3aa609569f8154afa175","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.904Z","epss":0.002,"epssPercentile":0.10124,"slug":"CVE-2026-90050","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fq: clamp quantum and initial_quantum in change path\n\nThe fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and\nTCA_FQ_INITIAL_QUANTUM up to INT_MAX, while fq_init() already clamps to\n[1, 1<<20]. A user can override the init clamp via tc qdisc change,\nrestoring the small-quantum deficit spin that the init clamp prevents.\n\nNarrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected at\nparse time. Clamp TCA_FQ_QUANTUM to [256, 1<<20] in fq_change() and\nfq_init() quantum to [256, 1<<20] for tiny-MTU devices.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_FQ=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root fq\n  tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 size_log 15 cell_log 0\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}