SB20260824103 - Uncontrolled Recursion in Linux kernel sched
Published: August 24, 2026
Security Bulletin ID
SB20260824103
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.
The issue affects the create-and-graft path that is not covered by the existing loop check.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6
- https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336
- https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540
- https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc
- https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01
- https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148