---
id: CVE-2026-98012
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: sfq: clamp quantum in change path

  sfq_change() accepts any non-negative quantum (only rejects
  (int)ctl->quantum < 0)
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: sfq: clamp quantum in change path

  sfq_change() accepts any non-negative quantum (only rejects
  (int)ctl->quantum < 0). With a crafted size table qdisc_pkt_le…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 82bd38bd5467ece1ee274b493f51326cf5220a5a <
    f3820dce042a673fcb28cc31c87ee14257e21a17
  - >-
    Linux >= e4650d7ae4252f67e997a632adfae0dd74d3a99a <
    534cd7ecbbc6e8a974f4003a5c1557439c6e0a72
  - >-
    Linux >= e4650d7ae4252f67e997a632adfae0dd74d3a99a <
    e6c1cb728e389354203a72bc77464c222a247aeb
  - >-
    Linux >= e4650d7ae4252f67e997a632adfae0dd74d3a99a <
    fb9f88a33c516ea5c0bcd9a22ca288b246b34567
  - Linux 843cacb88f42f426973f1ed11c6fb562558efb27
  - Linux 4919649699c5f4dbae08b8e2ed536fc9d6c3c2aa
  - Linux 548cf048b426729a7a1fa6acd1271c010c9a7380
  - Linux c49ac48fac51a6a54efd5963954d02bacf075085
  - Linux 58ae7465f0e7113d45aa88a66bf2d203c71c195e
  - Linux >= 6.12.13 < 6.12.111
  - Linux >= 5.4.297 < 5.5
  - Linux >= 5.10.239 < 5.11
  - Linux >= 5.15.186 < 5.16
  - Linux >= 6.1.129 < 6.2
  - Linux >= 6.6.76 < 6.7
  - Linux 6.13
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:29.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98012'
references:
  - url: 'https://git.kernel.org/stable/c/534cd7ecbbc6e8a974f4003a5c1557439c6e0a72'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e6c1cb728e389354203a72bc77464c222a247aeb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f3820dce042a673fcb28cc31c87ee14257e21a17'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb9f88a33c516ea5c0bcd9a22ca288b246b34567'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.858Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sfq: clamp quantum in change path

sfq_change() accepts any non-negative quantum (only rejects
(int)ctl->quantum < 0). With a crafted size table qdisc_pkt_len reaches
~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times
under the qdisc lock (a soft lockup / denial of service).

Add max(256U, ...) matching fq_codel_change(). Reject quantum > 1<<20
with -EINVAL, matching fq_codel_change() and the init clamp.

Conditions to recreate the bug:
  CONFIG_NET_SCH_SFQ=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root sfq
  tc qdisc change dev dummy0 root sfq quantum 1 stab data 32768 size_log 15 cell_log 0

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.