CVE-2026-98234

A flaw was found in the Linux kernel's Heavy-Hitter Filter (HHF) network packet scheduler. A local user with network administration privileges, such as within a container or user namespace, can set an excessively large flow limit due to missing upper-bound validation. When the system subsequently handles network traffic containing multiple new flows, it allocates memory without restriction. This issue allows an attacker to cause excessive memory consumption, resulting in a system crash and Denial of Service (DoS).

A low impact vulnerability was found in the Linux kernel's Heavy-Hitter Filter (HHF) network packet scheduler as shipped in Red Hat Enterprise Linux 8, including the RHEL CoreOS 8 kernel used in OpenShift Container Platform 4.12. The hh_flows_limit qdisc parameter (TCA_HHF_HH_FLOWS_LIMIT) was stored without an upper-bound check, so a local user with network administration privileges (CAP_NET_ADMIN, which an unprivileged user can obtain inside a user namespace or container) can configure an excessively large flow limit. When the system subsequently handles traffic containing many new flows, the kernel performs a fixed-size memory allocation for each newly classified heavy-hitter flow without an effective cap, allowing unbounded kernel memory consumption that can result in memory exhaustion, a system crash, and denial of service. The flaw provides no memory corruption, information disclosure, or privilege escalation primitive; its impact is limited to availability, and exploitation requires local access together with network administration privileges. For this reason Red Hat rates the impact as Low, lower than the Moderate severity indicated by the CVSS:3.1 base score of 5.5. The affected Red Hat Enterprise Linux 8 kernel and kernel-rt update streams and the RHEL CoreOS 8 component of OpenShift Container Platform 4.12 are currently marked affected with the fix deferred because of the low severity of this availability-only issue; the residual risk is that a local user holding the required privileges can still cause kernel memory exhaustion and denial of service on those systems. All other Red Hat products and update streams, including Red Hat Enterprise Linux 6, 7, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL CoreOS 9, are marked not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Only a user with the CAP_NET_ADMIN capability can trigger this flaw, because exploitation requires configuring the HHF queueing discipline through the tc utility. Avoiding the use of the HHF qdisc, or leaving its hh_limit parameter at the default value (2048), prevents the unbounded per-flow memory allocation. Additionally, on systems where untrusted local users can obtain CAP_NET_ADMIN inside user namespaces or containers, disabling or limiting the creation of unprivileged user namespaces (for example by setting the user.max_user_namespaces sysctl to 0) prevents such users from triggering this issue.