CVE-2026-90076

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq: add overflow bounds to quantum and initial quantum

fq_init() computes quantum = 2 * psched_mtu() and initial_quantum = 10 *

psched_mtu() with no overflow check. A device with a huge MTU (e.g. dummy

with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return

0x80000000; the 2 * and 10 * multiplications wrap to 0 in 32-bit

arithmetic, so q->quantum == 0. Then in fq_dequeue() the credit-refill

loop adds 0 to f->credit (which stays <= 0) and goto begin loops

forever under the qdisc lock, creating a soft lockup.

Clamp psched_mtu() to [1, 1 << 20] before multiplying so the product

cannot wrap, then cap the result at 1 << 20, matching the bound already

enforced on TCA_FQ_QUANTUM in fq_change().

Conditions to recreate the bug: a device whose MTU (plus

hard_header_len) is large enough that 2 * psched_mtu() wraps (e.g. a

dummy device with max_mtu == 0 accepting MTU 2147483634). Requires

CAP_NET_ADMIN

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References