SB20260928187 - Resource exhaustion in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2026-98010)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8382abec0f1568d0a5590d75a3df92f23fcf5196
• https://git.kernel.org/stable/c/8f756ae1c87414ce9cc21b30e6e4c036d6e9e80b
• https://git.kernel.org/stable/c/d43cded350fe1218493ad3d37a276aff14108ae6
• https://git.kernel.org/stable/c/dc8b374214ef5bba4882bbd95b361e42555cfc0d