CVE-2026-90073

A flaw was found in the Linux kernel. An integer overflow vulnerability exists in the Hierarchical Heavy-Hitter Filter (hhf) network scheduler when processing a device with a very large Maximum Transmission Unit (MTU). A local attacker with CAP_NET_ADMIN capabilities in a user namespace could exploit this by configuring a device with a huge MTU, causing an internal calculation to overflow. This overflow leads to an infinite loop in the hhf_dequeue() function, resulting in a Denial of Service (DoS) for the affected system.

A moderate-severity denial of service flaw was found in the Linux kernel's Hierarchical Heavy-Hitter Filter (hhf) queueing discipline (net/sched/sch_hhf.c). hhf_init() derives the qdisc quantum from the device MTU without an overflow check, so a device configured with a very large MTU causes the weight * quantum calculation to overflow the signed deficit counter in hhf_dequeue(). A local attacker with the CAP_NET_ADMIN capability, which can be obtained in an unprivileged user namespace, could exploit this by configuring such a device, causing the kernel to spin indefinitely in hhf_dequeue() and resulting in a denial of service (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 8 (kernel and kernel-rt) and OpenShift Container Platform 4.12 (RHCOS 8 kernel) are affected, with the fix currently deferred for these streams; until a fix is delivered, the residual risk is that a local attacker holding CAP_NET_ADMIN in a user namespace could trigger this kernel denial of service. Other Red Hat products, including Red Hat Enterprise Linux 6, 7, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform versions shipping the RHCOS 9 kernel, are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.