CVE-2026-98610

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve (HFSC) network packet scheduler. A local user with network administration privileges, such as within a user namespace, can exploit this flaw to cause a Denial of Service (DoS). Due to a lack of revalidation when traffic class levels are adjusted, conflicting filter configurations can create an infinite loop during packet classification. When network traffic traverses these cyclic rules, the system becomes unresponsive or crashes.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the denial of service requires local administrative capabilities—specifically network administration permissions, which unprivileged users can obtain only inside an unprivileged user namespace. The affected Hierarchical Fair Service Curve (HFSC) queuing discipline is not active by default and requires explicit traffic control configuration. Because the defect only results in a system hang or kernel panic without allowing unauthorized data access, modification, or privilege escalation, the severity does not rise to Important.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.