{"id":25485,"date":"2026-09-18T04:31:27","date_gmt":"2026-09-17T20:31:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90076"},"modified":"2026-09-18T04:31:27","modified_gmt":"2026-09-17T20:31:27","slug":"cve-2026-90076","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90076","title":{"rendered":"CVE-2026-90076 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/sched: fq: add ov"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq: add overflow bounds to quantum and initial quantum<\/p>\n<p>fq_init() computes quantum = 2 * psched_mtu() and initial_quantum = 10 *<br \/>\npsched_mtu() with no overflow check. A device with a huge MTU (e.g. dummy<br \/>\nwith max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return<br \/>\n0x80000000; the 2 * and 10 * multiplications wrap to 0 in 32-bit<br \/>\narithmetic, so q-&gt;quantum == 0. Then in fq_dequeue() the credit-refill<br \/>\nloop adds 0 to f-&gt;credit (which stays &lt;= 0) and goto begin loops<br \/>\nforever under the qdisc lock, creating a soft lockup.<\/p>\n<p>Clamp psched_mtu() to [1, 1 &lt;&lt; 20] before multiplying so the product<br \/>\ncannot wrap, then cap the result at 1 &lt;&lt; 20, matching the bound already<br \/>\nenforced on TCA_FQ_QUANTUM in fq_change().<\/p>\n<p>Conditions to recreate the bug: a device whose MTU (plus<br \/>\nhard_header_len) is large enough that 2 * psched_mtu() wraps (e.g. a<br \/>\ndummy device with max_mtu == 0 accepting MTU 2147483634). Requires<br \/>\nCAP_NET_ADMIN in a user namespace.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: fq: add overflow bounds to quantum and initial quantum<\/p>\n<p>fq_init() computes quantum = 2 * psched_mtu() and initial_quantu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}