CVE-2026-98012

A flaw was found in the Linux kernel's Stochastic Fairness Queueing (SFQ) network packet scheduling subsystem. A local attacker with network administration privileges, including within an unprivileged user namespace, can supply an improperly bounded quantum parameter alongside a crafted packet size table. This can trigger an excessively long execution loop while holding an internal lock, leading to a system lockup and a Denial of Service (DoS).

A low impact denial of service flaw was found in the Linux kernel's Stochastic Fairness Queueing (SFQ) network packet scheduler (net/sched/sch_sfq.c). The sfq_change() function did not properly clamp the user-controlled quantum parameter, accepting any non-negative value. A local attacker with CAP_NET_ADMIN privileges, which can also be obtained inside an unprivileged user namespace via 'unshare -Urn', can combine a very small quantum value with a crafted packet size table so that qdisc_pkt_len reaches roughly 2 GiB, causing the deficit-refill loop to iterate approximately 2^31 times while holding the qdisc lock. This results in a kernel soft lockup and denial of service of the affected system; confidentiality and integrity are not impacted. Although the CVSS:3.1 base score is 5.5 (Moderate) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Red Hat rated the impact of this flaw as Low because exploitation requires local access with CAP_NET_ADMIN and the consequence is limited to a CPU soft lockup. The vulnerable code is present only in Red Hat Enterprise Linux 9.8.z, 9.9, and 9.10, Red Hat Enterprise Linux 10.2.z, 10.3, and 10.4, Red Hat In-Vehicle OS 2.0.z and 2.1 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (RHEL CoreOS 9 kernel); these streams are marked for a deferred fix. Older Red Hat Enterprise Linux 7 and 8 streams, the RHEL 9.2, 9.4, and 9.6.z and RHEL 10.0.z update streams, kernel-rt streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in them. Because the fix is deferred to a future update, the residual risk remains a local denial of service by an attacker who holds CAP_NET_ADMIN privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.