VulnerabilityPublished 17 Sep 2026Updated 5 Oct 2026

CVE-2026-90058: Linux kernel · net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Affects Linux kernelSource GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 15:59 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Ubuntu 26.04 LTSlinux`pkg:deb/ubuntu/linux?arch=source&distro=resolute`Other threats	Affected 6.17.0-5.5 – 7.0.0-38.38 23 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=resolute`Other threats	Affected 6.17.0-1002.2 – 7.0.0-1014.14 15 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=resolute`Other threats	Affected 6.17.0-1003.3 – 7.0.0-1017.17 15 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resolute`Other threats	Affected 7.0.0-1003.3 – 7.0.0-1016.16 9 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=resolute`Other threats	Affected 6.17.0-1002.2 – 7.0.0-1014.14 13 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-gke`pkg:deb/ubuntu/linux-gke?arch=source&distro=resolute`Other threats	Affected 7.0.0-1002.3 – 7.0.0-1008.9 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available that caps the qdisc_pkt_len() value to prevent excessive looping in deficit schedulers. Users should apply the updated Linux kernel versions that include this patch. Until patched, avoid using DRR or ETS qdiscs with crafted size tables and tiny quantum values, and restrict CAP_NET_ADMIN privileges in user and network namespaces. Patch status is not explicitly stated in the input data; users should consult the vendor advisory or Linux kernel security updates for the official fix.

Description

A vulnerability in the Linux kernel's network scheduler (net/sched) allows crafted size tables to cause a soft lockup by amplifying packet length calculations, leading to excessive looping in deficit schedulers such as DRR and ETS. This can cause the kernel to hang or panic due to a soft lockup or RCU stall. The issue affects certain kernel versions with specific configurations and can be triggered by a user with CAP_NET_ADMIN in a user and network namespace. The vulnerability has been resolved by capping the maximum packet length amplification to prevent unbounded loops.

Impact

Exploitation of this vulnerability can cause a kernel soft lockup or RCU stall, leading to system hang or panic if kernel.softlockup_panic=1 is set. This impacts system availability by causing the kernel to become unresponsive under crafted network scheduler configurations. The vulnerability requires specific kernel configurations and privileges, limiting its attack surface to environments where these conditions are met.

Summary

The Linux kernel vulnerability CVE-2026-90058 involves the net/sched subsystem where the function qdisc_get_stab() accepts a user-supplied size table that can be manipulated to set qdisc_pkt_len() to approximately 1 GiB for a normal skb. This causes deficit schedulers like DRR and ETS, which replenish one quantum per loop iteration, to spin billions of times under the qdisc lock when a tiny quantum (1) is used, resulting in a soft lockup or RCU stall. The fix introduces a cap (QDISC_PKT_LEN_MAX) of 1 MiB on qdisc_pkt_len() to limit the loop iterations to about 1 million, preventing the soft lockup. The vulnerability requires CONFIG_NET_SCHED and either CONFIG_NET_SCH_DRR or CONFIG_NET_SCH_ETS enabled, and can be exploited by root or unprivileged users with CAP_NET_ADMIN in a fresh user+net namespace.

GCVE source: db.gcve.eu
OSV ID: UBUNTU-CVE-2026-90058
Osv Schema Version: 1.7.0
Ecosystems: Ubuntu:Pro:14.04:LTS, Ubuntu:Pro:16.04:LTS, Ubuntu:16.04:LTS, Ubuntu:Pro:FIPS:16.04:LTS, Ubuntu:Pro:18.04:LTS, Ubuntu:18.04:LTS, Ubuntu:Pro:FIPS-updates:18.04:LTS, Ubuntu:Pro:FIPS:18.04:LTS, Ubuntu:Pro:20.04:LTS, Ubuntu:20.04:LTS, Ubuntu:Pro:FIPS-updates:20.04:LTS, Ubuntu:Pro:FIPS:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:Nvidia-BlueField:22.04:LTS, Ubuntu:Pro:FIPS-preview:22.04:LTS, Ubuntu:Pro:FIPS-updates:22.04:LTS, Ubuntu:Pro:Realtime:22.04:LTS, Ubuntu:24.04:LTS, Ubuntu:Nvidia-BlueField:24.04:LTS, Ubuntu:Pro:FIPS-updates:24.04:LTS, Ubuntu:Pro:Realtime:24.04:LTS, Ubuntu:26.04:LTS

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Oct 2026, 21:09 UTC

Technical details

References

Community reviews

Related threats