CVE-2026-90109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

gred_enqueue(), bfifo_enqueue() and plug_enqueue() admit a packet when the

current backlog plus the packet length fits within the queue limit:

sch->qstats.backlog + qdisc_pkt_len(skb) <= sch->limit (gred default VQ)

gred_backlog+qdisc_pkt_len(skb) <= q->limit (gred configured VQ)

sch->qstats.backlog + qdisc_pkt_len(skb) <= sch->limit (bfifo)

sch->qstats.backlog + skb->len <= q->limit (plug)

sch->qstats.backlog and q->backlog are u32, and qdisc_pkt_len()/skb->len

are unsigned int, so all sums are computed in 32 bits and wrap at 2^32.

Once the true backlog exceeds 4 GiB the wrapped sum becomes small and

admission keeps succeeding, so the queue grows without bound and the kernel

can be driven to OOM.

Promote the sums to u64 so admission stops once the true backlog exceeds

the limit. The limit is u32, so the bounded queue stays b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References