Allocation of Resources Without Limits or Throttling in Linux kernel - CVE-2026-98234
Published: October 7, 2026
Vulnerability identifier: #VU153779
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98234
CWE-ID: CWE-770
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits in the heavy-hitter filter (HHF) queuing discipline when processing heavy-hitter flows with an excessively large configured flow limit. A local user can configure an oversized hh_limit and generate spoofed traffic to cause a denial of service.
Exploitation requires CAP_NET_ADMIN in a user namespace.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98234
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/06d2a101e89063cb0b9b459104db48bdfb0a797d
- https://git.kernel.org/stable/c/1731ff1d20489afe4cd01b7d16d37f324746ac54
- https://git.kernel.org/stable/c/2cef2588c995722a901368def30befeef9ae55c6
- https://git.kernel.org/stable/c/35fd423a5c5132c6f4321f6c4f0a7b4b90af830c
- https://git.kernel.org/stable/c/7adfd0a42174b85c6bd678858ecd6674f403f336
- https://git.kernel.org/stable/c/d8e2f1f0263b7c97b222c06070cccf13e0ab7112
- https://git.kernel.org/stable/c/f3f4a5cb4a6e9b1f1f25d34dfc25f836a1601db4
- https://git.kernel.org/stable/c/f6547d27ce2093c5627636fb63dd0b7523c466f9