In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget… (CVE-2026-98610)

The Linux kernel's HFSC (Hierarchical Fair Service Curve) scheduler had a vulnerability where the classify inner-filter walk was unbounded when levels drifted after bind time. Specifically, hfsc_classify() did not revalidate bindings after a class's level was raised, allowing two classes to point to each other and causing the classify walk to bounce indefinitely while holding the qdisc lock and BH disabled. This results in a soft lockup detected by the kernel watchdog. The fix introduces a cumulative budget limiting non-descending hops during classification, preventing infinite loops. If the budget is exhausted, the packet is dropped with a rate-limited warning. This vulnerability can be triggered by unprivileged users with CAP_NET_ADMIN privileges via unshare -Urn.

Exploitation causes a soft lockup of the CPU, effectively a denial of service condition on the affected system. The kernel watchdog detects the stuck classify walk and reports a soft lockup, which can lead to system instability or panic if configured. The vulnerability is reachable by unprivileged users with CAP_NET_ADMIN capabilities, increasing the risk of local denial of service.

A fix is available that bounds the classify inner-filter walk with a drift budget to prevent infinite loops. Systems should apply the official Linux kernel patches that implement this fix. Until patched, avoid untrusted users having CAP_NET_ADMIN privileges or access to unshare -Urn namespaces. Monitor vendor advisories for the specific kernel versions patched.