CVE-2026-98011

A flaw was found in the Linux kernel's Heavy-Hitter Filter (HHF) network scheduler. A local attacker with network administration privileges, which can be acquired within an unprivileged user namespace, can cause a Denial of Service (DoS). By setting an excessively small quantum value alongside a crafted packet size table, an attacker forces the scheduler into an extensive processing loop while holding a lock, resulting in a system soft lockup.

A low severity denial of service vulnerability was found in the Linux kernel's Heavy-Hitter Filter (HHF) queueing discipline (net/sched/sch_hhf.c). The hhf_change() function accepts an arbitrarily small quantum value from userspace: when the HHF qdisc is configured with quantum=1 together with a crafted packet size table (for example via the tc command), the deficit-refill loop iterates roughly 2^31 times while holding the qdisc lock, causing a kernel soft lockup and a local denial of service. Triggering the flaw requires CAP_NET_ADMIN privileges, which an unprivileged local user can obtain inside an unprivileged user namespace on kernels built with CONFIG_NET_SCH_HHF; only system availability is affected, with no impact on confidentiality or integrity. In Red Hat's products the vulnerable code is present in Red Hat Enterprise Linux 8 (kernel and kernel-rt) and in the RHEL 8 based OpenShift Container Platform 4.12 CoreOS image, where the fix has been deferred to a future update because the flaw is rated low severity and exploitation requires (namespace-local) CAP_NET_ADMIN privileges for a denial-of-service-only impact; the residual risk is a soft lockup or temporary system hang on affected hosts where untrusted local users are able to create user namespaces. Red Hat Enterprise Linux 6, 7, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL CoreOS 9 are not affected because the vulnerable code is not present in those releases. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as low because successful exploitation requires CAP_NET_ADMIN (even if obtainable within an unprivileged user namespace) and the result is limited to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The flaw can only be triggered by a user holding CAP_NET_ADMIN. On affected systems, exposure to attacks from unprivileged local users can be reduced by preventing the creation of unprivileged user namespaces, which is the path by which such users can acquire CAP_NET_ADMIN. This can be done by setting the sysctl user.max_user_namespaces to 0, for example with 'sysctl -w user.max_user_namespaces=0' (persisted via a file in /etc/sysctl.d/). Restricting CAP_NET_ADMIN to trusted administrators likewise prevents unprivileged exploitation. Note that disabling unprivileged user namespaces may affect workloads that rely on them, such as unprivileged containers.