Integer overflow in Linux kernel - CVE-2026-90073
Published: September 19, 2026
Vulnerability identifier: #VU151409
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90073
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an integer overflow in the HHF queuing discipline's hhf_dequeue() function when configuring an HHF qdisc on a device with an oversized MTU. A local user can configure the HHF qdisc to trigger an infinite loop to cause a denial of service.
Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard-header length wraps psched_mtu() into the sign bit.
Affected software
Linux kernel
How to mitigate CVE-2026-90073
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0c66223e90ddb4fd3700965a9241f2fde7bd6bc7
- https://git.kernel.org/stable/c/20b65bf7ca06e48ec1d62ed8012f71205328dbe4
- https://git.kernel.org/stable/c/2164b512b97bb053e8ce4d6e95576f11bed6a005
- https://git.kernel.org/stable/c/2446644b0f6d045b01db6acbaf55552dbec8a59a
- https://git.kernel.org/stable/c/2e0f0729f922c8de13801004e2131b57646c7c5f
- https://git.kernel.org/stable/c/99770b5d8e0e1c69b996f74a19d71afd2c4a9aa4
- https://git.kernel.org/stable/c/dea2789a9d5ff38bdd77f2e64d550430899e2839
- https://git.kernel.org/stable/c/fa9c2055f0a60f801ccf286af53d387dc6202c3f