Uncontrolled Recursion in Linux kernel - CVE-2026-74663

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

Affected software

How to mitigate CVE-2026-74663

External References

• https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6
• https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336
• https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540
• https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc
• https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01
• https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148

Related Security Bulletins

• Uncontrolled Recursion in Linux kernel sched
• Debian update for linux