VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98012: Linux kernel · net/sched: sfq: clamp quantum in change path

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fb9f88a33c516ea5c0bcd9a22ca288b246b34567 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fb9f88a33c516ea5c0bcd9a22ca288b246b34567, f3820dce042a673fcb28cc31c87ee14257e21a17, f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0 +11

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.239 <5.10.271 >=5.15.186 <5.15.222 >=6.1.129 <6.1.189 >=6.6.76 <6.6.158 >=6.12.13 <6.12.111 >=5.4.297 <5.5	Fixed in fb9f88a33c516ea5c0bcd9a22ca288b246b34567 f3820dce042a673fcb28cc31c87ee14257e21a17 f82fa6f10d4a69322cad0f7a4aa523ce6292a5a0 e4192bcf83aaab02129644ddf4656fd86e93751f e6c1cb728e389354203a72bc77464c222a247aeb 4117c528b2de5fdc3e4a7e3626815b616a635cdc 0692ce5a528df450d64e9f819054177e9d91076f 534cd7ecbbc6e8a974f4003a5c1557439c6e0a72 6.12.111 6.6.158 6.1.189 5.15.222 5.10.271 5.5
LinuxLinux	Affected =6.13	Fixed in–

AI-suggested

This vulnerability has been fixed in multiple Linux kernel versions as indicated by the fixed commit hashes and version numbers. Users should upgrade to one of the fixed kernel versions listed (e.g., 5.10.271 or later, 5.15.222 or later, 6.1.189 or later, 6.6.158 or later, 6.12.111 or later). No additional mitigation is required once the system is updated. If upgrading is not immediately possible, restricting CAP_NET_ADMIN privileges can reduce risk since exploitation requires this capability.

Description

A vulnerability in the Linux kernel's net/sched subsystem related to the sfq (Stochastic Fairness Queueing) queuing discipline allows a crafted quantum value to cause a denial of service via a soft lockup. The issue arises because sfq_change() accepts any non-negative quantum, enabling a crafted packet length to trigger a long spinning loop under the qdisc lock. This can cause a denial of service condition. The vulnerability affects specific Linux kernel versions and has been fixed by clamping the quantum value and rejecting excessively large values.

Impact

Exploitation of this vulnerability can cause a denial of service by triggering a soft lockup in the kernel's network scheduling subsystem. This can degrade system responsiveness or cause the affected system to become unresponsive under certain conditions when the sfq queuing discipline is used and manipulated with crafted parameters.

Summary

The Linux kernel's sfq_change() function in the net/sched subsystem improperly accepts any non-negative quantum value, only rejecting negative values. An attacker with CAP_NET_ADMIN privileges can craft a size table such that qdisc_pkt_len reaches approximately 2 GiB, and setting quantum=1 causes the deficit-refill loop to spin about 2^31 times under the qdisc lock. This results in a soft lockup and denial of service. The fix adds a clamp to the quantum value, enforcing a minimum of 256 and rejecting quantum values greater than 1<<20 with an error, aligning with fq_codel_change() behavior. The vulnerability requires the CONFIG_NET_SCH_SFQ kernel configuration and appropriate capabilities to exploit.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:06 UTC

Technical details

References

Community reviews

Related threats