CVE-2026-90075

A flaw was found in the Linux kernel's fq_codel network scheduler. A local attacker with CAP_NET_ADMIN capabilities in a user namespace could exploit this by configuring a network device with an extremely large Maximum Transmission Unit (MTU). This can lead to an integer overflow, causing an infinite loop and a system soft lockup, resulting in a Denial of Service (DoS). Additionally, it can silently disable the CoDel (Controlled Delay) mechanism, preventing proper network congestion management.

A moderate impact flaw was found in the Linux kernel's fq_codel network scheduler (net/sched) in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 (through the RHEL CoreOS 8 and 9 kernels). In fq_codel_init(), the default quantum is taken from psched_mtu() without clamping, and the same unclamped value is assigned to the CoDel mtu parameter. A local attacker with the CAP_NET_ADMIN capability in a user namespace could exploit this by configuring a network device with an extremely large MTU (for example, a dummy device with max_mtu == 0 accepting MTU 2147483634), which makes psched_mtu() return 0x80000000. That value overflows the signed flow->deficit counter in fq_codel_dequeue(), causing an infinite loop and a kernel soft lockup, resulting in a denial of service. The unclamped mtu also makes the codel_should_drop() backlog test always true, silently and completely disabling CoDel congestion management (no drops, no ECN) on the affected qdisc. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that kernel. Fixes for the affected products are deferred to a future update; until then, the residual risk is a local denial of service or loss of CoDel congestion control on systems where an untrusted local user can obtain CAP_NET_ADMIN in a user namespace. Red Hat rates this flaw as Moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.