---
id: CVE-2026-90075
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: fq_codel: clamp default quantum and mtu

  fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without
  clamping
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: fq_codel: clamp default quantum and mtu

  fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without
  clamping. A device with a huge MTU (e.g. dummy …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    d315ee8a07fd1810880227319cf60e6cd925ef22
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    a9a5b2943a00df2ab81a2209f31dd9e87016f120
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    3782067ec0d485628b6f1f9ede3eeeb4f611fcf2
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    397e2b1f71d9f15b8b4e47d24eb620e4dff8878d
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    324f86806673ae4a55f66d28db84577f46f615e1
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    dfb4b61db886917244284b18b44b23d2254b82c2
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    d9ebd8f9aa8b2773235889cb903fafd61f2d8585
  - Linux 3.5
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:56.670'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90075'
references:
  - url: 'https://git.kernel.org/stable/c/324f86806673ae4a55f66d28db84577f46f615e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3782067ec0d485628b6f1f9ede3eeeb4f611fcf2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/397e2b1f71d9f15b8b4e47d24eb620e4dff8878d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9f499e5827fdb6d7fdb46a7ce731852f6b1a1bb9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a9a5b2943a00df2ab81a2209f31dd9e87016f120'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d315ee8a07fd1810880227319cf60e6cd925ef22'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d9ebd8f9aa8b2773235889cb903fafd61f2d8585'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfb4b61db886917244284b18b44b23d2254b82c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.897Z'
epss: 0.00211
epssPercentile: 0.10035
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_codel: clamp default quantum and mtu

fq_codel_init() sets q->quantum = psched_mtu(qdisc_dev(sch)) without
clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0
accepting MTU 2147483634) makes psched_mtu() return 0x80000000, which
overflows the signed flow->deficit to INT_MIN in fq_codel_dequeue(),
causing an infinite loop and soft lockup. Emulate fq_codel_change()
and constrain to [256, FQ_CODEL_QUANTUM_MAX].

The same unclamped psched_mtu() is assigned to q->cparams.mtu a bit
below, and fq_codel_change() never updates it. codel_should_drop()
tests "*backlog <= params->mtu"; with mtu == 0x80000000 (~2 GiB) and
the default 32 MiB memory_limit, the test is always true, so CoDel is
silently and completely disabled (no drops, no ECN). Declare a single
clamped mtu and assign both q->quantum and q->cparams.mtu from it,
which also removes the double psched_mtu() call.

Conditions to recreate the bug: a device whose MTU (plus
hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy
device with max_mtu == 0 accepting MTU 2147483634). Requires
CAP_NET_ADMIN in a user namespace.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.