CVE-2026-98013: Linux kernel · net/sched: fq_pie: clamp quantum in change path
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 17:16 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a patch is available, restrict CAP_NET_ADMIN privileges to trusted users only to prevent exploitation. Avoid setting the quantum parameter to 1 in fq_pie qdisc configurations.
Description
A vulnerability in the Linux kernel's fq_pie network scheduler allows users with CAP_NET_ADMIN capability to cause a denial of service via a crafted quantum value. Specifically, the fq_pie_change() function accepts any quantum value from userspace, including 1, which can cause a soft lockup due to a long spinning loop under the qdisc lock. This issue affects certain versions of the linux-hwe-edge kernel and requires specific configuration and commands to trigger.
References
- ubuntu.com/security/CVE-2026-98013 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98013 (opens in a new tab)
- git.kernel.org/stable/c/6655b56e2801008566c594ef231f6c7b3f716c61 (opens in a new tab)
- git.kernel.org/stable/c/4864f58c53eb47257d55e01f47d4a9f355f7f970 (opens in a new tab)
- git.kernel.org/stable/c/f90fe65b977e7aa9eb302230a09eb18f8c32ceaa (opens in a new tab)
- git.kernel.org/stable/c/c11e3a39807eb5a200445ae9082843ab86800415 (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-98013 (opens in a new tab)
- git.kernel.org/stable/c/215df1e953ae72a09d425ec188e054058ae23dc9 (opens in a new tab)
- git.kernel.org/stable/c/749aaebc1eb92ce2f38fd3caf68a2f99686d84ef (opens in a new tab)
- git.kernel.org/stable/c/8fd98e56c41f79278eeb67512c28d7abc175bcf4 (opens in a new tab)
- git.kernel.org/stable/c/ff4f3a0f3abd2ded467931d7da7984a68a768e0b (opens in a new tab)