{"id":25484,"date":"2026-09-18T04:31:26","date_gmt":"2026-09-17T20:31:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90075"},"modified":"2026-09-18T04:31:26","modified_gmt":"2026-09-17T20:31:26","slug":"cve-2026-90075","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90075","title":{"rendered":"CVE-2026-90075 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/sched: fq_codel:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq_codel: clamp default quantum and mtu<\/p>\n<p>fq_codel_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) without<br \/>\nclamping. A device with a huge MTU (e.g. dummy with max_mtu == 0<br \/>\naccepting MTU 2147483634) makes psched_mtu() return 0x80000000, which<br \/>\noverflows the signed flow-&gt;deficit to INT_MIN in fq_codel_dequeue(),<br \/>\ncausing an infinite loop and soft lockup. Emulate fq_codel_change()<br \/>\nand constrain to [256, FQ_CODEL_QUANTUM_MAX].<\/p>\n<p>The same unclamped psched_mtu() is assigned to q-&gt;cparams.mtu a bit<br \/>\nbelow, and fq_codel_change() never updates it. codel_should_drop()<br \/>\ntests &#8220;*backlog mtu&#8221;; with mtu == 0x80000000 (~2 GiB) and<br \/>\nthe default 32 MiB memory_limit, the test is always true, so CoDel is<br \/>\nsilently and completely disabled (no drops, no ECN). Declare a single<br \/>\nclamped mtu and assign both q-&gt;quantum and q-&gt;cparams.mtu from it,<br \/>\nwhich also removes the double psched_mtu() call.<\/p>\n<p>Conditions to recreate the bug: a device whose MTU (plus<br \/>\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy<br \/>\ndevice with max_mtu == 0 accepting MTU 2147483634). Requires<br \/>\nCAP_NET_ADMIN in a user namespace.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq_codel: clamp default quantum and mtu<\/p>\n<p>fq_codel_init() sets q-&gt;quantum = psched_mtu(qdisc_dev(sch)) without<br \/>\nclamping. <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25484","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}