CVE-2026-98610

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

hfsc_classify() applies the "filter may only point downwards" level check

only when the filter result carries no bound class. A filter created with

a flowid gets res.class set once at bind time, so the check never runs for

it during classification. hfsc_adjust_levels() can later raise a class's

level without revalidating existing bindings, leaving two binds that were

each legal at bind time pointing at each other; the classify walk then

bounces between two interior classes forever with the qdisc lock held and

BH disabled — a soft lockup from a single packet. The stuck walk trips

the watchdog:

watchdog: BUG: soft lockup - CPU#3 stuck for 13s! [ping:444]

RIP: 0010:u32_classify+0x542/0x17f0

...

tcf_classify+0x66/0xa0

hfsc_enqueue+0x166/0xdf0

Bound the traversal with a budget of non-descending hops, the only way a

configured walk ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References