SB20260928186 - Infinite loop in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Infinite loop (CVE-ID: CVE-2026-98009)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of ETS quantum values in the ETS queuing discipline when configuring an ETS qdisc with crafted quantum values. A local user can configure a crafted ETS qdisc to cause a denial of service.

The issue requires CONFIG_NET_SCH_ETS and CAP_NET_ADMIN; namespace-local capabilities are sufficient.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1c38487f46b243bfeefec0c0c86023a3904f2214
• https://git.kernel.org/stable/c/8f80b113dea0bed3c1a31a4224b72775cd9ec52d
• https://git.kernel.org/stable/c/99ae477b892e203a37985ebc56f0063e072f7f4b
• https://git.kernel.org/stable/c/de22c30ec5598aca8797f02082d2ee1358dfa3ff