{"id":25483,"date":"2026-09-18T04:31:26","date_gmt":"2026-09-17T20:31:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90074"},"modified":"2026-09-18T04:31:26","modified_gmt":"2026-09-17T20:31:26","slug":"cve-2026-90074","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90074","title":{"rendered":"CVE-2026-90074 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/sched: fq_pie: cl"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq_pie: clamp default quantum to avoid signed overflow<\/p>\n<p>fq_pie_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) without<br \/>\nclamping. A device with a huge MTU (e.g. dummy with max_mtu == 0<br \/>\naccepting MTU 2147483634) makes psched_mtu() return 0x80000000, which<br \/>\noverflows the signed flow-&gt;deficit to INT_MIN in fq_pie_qdisc_dequeue(),<br \/>\ncausing an infinite loop and soft lockup. Emulate fq_pie_policy which<br \/>\nis already bounded to [1, 1 &lt;&lt; 20]; clamp the default to [256, 1 &lt;&lt; 20].<br \/>\n256 matches fq_codel&#039;s floor and is a sane minimum for a DRR quantum.<\/p>\n<p>Conditions to recreate the bug: a device whose MTU (plus<br \/>\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy<br \/>\ndevice with max_mtu == 0 accepting MTU 2147483634). Requires<br \/>\nCAP_NET_ADMIN in a user namespace.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq_pie: clamp default quantum to avoid signed overflow<\/p>\n<p>fq_pie_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) witho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25483","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}