CVE-2026-98009

A flaw was found in the Linux kernel's Enhanced Transmission Selection (ETS) network scheduler. A local user with network administration privileges, including an unprivileged user inside a user namespace, can configure traffic control queue disciplines with invalid or unconstrained quantum parameters. This flaw causes an internal deficit-refill loop to spin indefinitely while holding a scheduler lock, leading to a system hang and Denial of Service (DoS).

A low impact local denial of service flaw was found in the Linux kernel's Enhanced Transmission Selection (ETS) traffic control scheduler. When an ETS queueing discipline is configured with an unconstrained quantum value, or when it falls back to psched_mtu(), which can return zero on headerless devices, the scheduler's deficit-refill loop can spin indefinitely while holding the queueing discipline lock. A local attacker with the CAP_NET_ADMIN capability, which an otherwise unprivileged user can gain inside an unprivileged user namespace, can exploit this to hang the affected system, causing a denial of service. The kernel must include the ETS scheduler (CONFIG_NET_SCH_ETS) for the system to be vulnerable; confidentiality and integrity are not impacted.

Red Hat Enterprise Linux 8, 9, and 10 (including the Real Time kernel streams), RHIVOS 2, and the RHEL CoreOS kernels used by OpenShift Container Platform are affected. For these products the fix has been deferred: because this is a privilege-gated local denial of service rated low impact, it will be addressed in a future scheduled kernel update rather than an immediate erratum. The residual risk until the fix is delivered is that a local user able to configure traffic control queueing disciplines can hang an affected system. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.