---
id: CVE-2026-98011
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: hhf: clamp quantum in change and init paths

  hhf_change() accepts any quantum from userspace, including 1
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: hhf: clamp quantum in change and init paths

  hhf_change() accepts any quantum from userspace, including 1. With a
  crafted size table qdisc_pkt_len reaches ~2…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 10239edf86f137ce4c39b62ea9575e8053c549a0 <
    1113b674307ffddd402524bd1fd9d7d5629b705b
  - >-
    Linux >= 10239edf86f137ce4c39b62ea9575e8053c549a0 <
    2e77947bbf6c166e76c038663832d0914418f761
  - >-
    Linux >= 10239edf86f137ce4c39b62ea9575e8053c549a0 <
    0898c6f9fa9ce2632ae88bd0f34a878ccc6335af
  - >-
    Linux >= 10239edf86f137ce4c39b62ea9575e8053c549a0 <
    eb56a495f59baf6cad5ed80e3ffb9078098b1346
  - Linux 3.14
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:29.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98011'
references:
  - url: 'https://git.kernel.org/stable/c/0898c6f9fa9ce2632ae88bd0f34a878ccc6335af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1113b674307ffddd402524bd1fd9d7d5629b705b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2e77947bbf6c166e76c038663832d0914418f761'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb56a495f59baf6cad5ed80e3ffb9078098b1346'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.859Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: clamp quantum in change and init paths

hhf_change() accepts any quantum from userspace, including 1. With a
crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes
the deficit-refill loop spin ~2^31 times under the qdisc lock
(a soft lockup / denial of service).

Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp
hhf_init() to [256, 1<<20] matching the siblings, and remove the old
fallback that only set quantum=256 on overflow.

Conditions to recreate the bug:
  CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root hhf
  tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.