CVE-2026-98010: Linux kernel · net/sched: drr: clamp quantum in change class
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in e2297bbf9cf6ece86f1d1f8c683517a994990f9e : patch Linux kernel soon.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in e2297bbf9cf6ece86f1d1f8c683517a994990f9e, dc8b374214ef5bba4882bbd95b361e42555cfc0d, d43cded350fe1218493ad3d37a276aff14108ae6 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This vulnerability has been fixed in the Linux kernel as indicated by multiple fixed commit versions. Users should update to a Linux kernel version that includes these fixes. No additional mitigation is required once the kernel is updated.
Description
A vulnerability in the Linux kernel's net/sched drr (Deficit Round Robin) scheduler allows a crafted quantum value to cause a spin loop under the qdisc lock. This occurs because drr_change_class() rejects an explicit quantum of zero but falls back to a function with no minimum floor, enabling a crafted size table to cause the quantum to be effectively very large, leading to a spin loop. The issue requires the CONFIG_NET_SCH_DRR option enabled and CAP_NET_ADMIN privileges. The vulnerability has been fixed by clamping the quantum value within a safe range.
References
- git.kernel.org/stable/c/e2297bbf9cf6ece86f1d1f8c683517a994990f9e (opens in a new tab)
- git.kernel.org/stable/c/560794ee6e040b6e1c4ac2b3c8909f341a4596ee (opens in a new tab)
- git.kernel.org/stable/c/23fea7e6736b2e1c6f6f2f05cccf33d36834da73 (opens in a new tab)
- git.kernel.org/stable/c/b464affe9f9dfe41ac48930c376e3fb8596651b0 (opens in a new tab)
- git.kernel.org/stable/c/dc8b374214ef5bba4882bbd95b361e42555cfc0d (opens in a new tab)
- git.kernel.org/stable/c/d43cded350fe1218493ad3d37a276aff14108ae6 (opens in a new tab)
- git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b (opens in a new tab)
- git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196 (opens in a new tab)