{"id":25481,"date":"2026-09-18T04:31:26","date_gmt":"2026-09-17T20:31:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90072"},"modified":"2026-09-18T04:31:26","modified_gmt":"2026-09-17T20:31:26","slug":"cve-2026-90072","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90072","title":{"rendered":"CVE-2026-90072 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/sched: sfq: clamp"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: sfq: clamp quantum to avoid signed overflow soft lockup<\/p>\n<p>sfq_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) (unsigned). A<br \/>\ndevice with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU<br \/>\n2147483634) makes psched_mtu() return 0x80000000, so slot-&gt;allot = INT_MIN<br \/>\nand INT_MIN + INT_MIN toggles between INT_MIN and 0 forever, spinning<br \/>\nsfq_dequeue() under the qdisc lock.<\/p>\n<p>Clamp the quantum to [256, 1 &lt;quantum == 0 (psched_mtu() returning 0),<br \/>\nwhich spins sfq_dequeue() identically. sfq_change() already rejects a<br \/>\nnegative quantum, so only the init path was exposed.<\/p>\n<p>Conditions to recreate the bug: a device whose MTU (plus<br \/>\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy<br \/>\ndevice with max_mtu == 0 accepting MTU 2147483634). Requires<br \/>\nCAP_NET_ADMIN in a user namespace.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: sfq: clamp quantum to avoid signed overflow soft lockup<\/p>\n<p>sfq_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) (unsign<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25481","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25481"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25481"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}