{"cve":"CVE-2026-98010","nvd":{"published":"2026-09-25T11:17:29.320","modified":"2026-10-19T10:17:52.400","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: drr: clamp quantum in change class\n\ndrr_change_class() rejects explicit quantum==0 but falls back to\npsched_mtu() with no floor. With a crafted size table qdisc_pkt_len\nreaches ~2 GiB, so quantum=1 (or a zero psched_mtu on a headerless\ndevice) makes the deficit-refill loop spin under the qdisc lock.\n\nAdd clamp_t(u32, quantum, 256, 1<<20) after the zero reject and on the\nfallback path. The explicit-zero reject is preserved.\n\nConditions to recreate the bug:\n  CONFIG_NET_SCH_DRR=y. Requires CAP_NET_ADMIN (namespace-local via\n  unshare -Urn suffices).\n\n  tc qdisc add dev dummy0 root drr\n  tc class add dev dummy0 parent 1: classid 1:1 drr quantum 1","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/23fea7e6736b2e1c6f6f2f05cccf33d36834da73","https://git.kernel.org/stable/c/560794ee6e040b6e1c4ac2b3c8909f341a4596ee","https://git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196","https://git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b","https://git.kernel.org/stable/c/b464affe9f9dfe41ac48930c376e3fb8596651b0"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-98010","score":0.00177,"percentile":0.07169,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}