Infinite loop in Linux kernel - CVE-2026-98610

Vulnerability identifier: #VU156917

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98610

CWE-ID: CWE-835

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service by triggering an infinite packet-classification loop and a CPU soft lockup in the Linux kernel.

The vulnerability exists due to an infinite loop in hfsc_classify() in net/sched/sch_hfsc.c when class-level changes leave previously valid flowid bindings forming a cycle that bypasses the downward-level check. A local user can configure cyclic HFSC filter bindings and send a single packet through the affected queue to cause packet classification to loop indefinitely with the qdisc lock held and bottom halves disabled.

The required network configuration is reachable by an unprivileged user through unshare -Urn, which provides CAP_NET_ADMIN within the new user and network namespaces.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0fa25ba50a382d79c0cf060214c2095756836f5f
• https://git.kernel.org/stable/c/1301a1292c6742b4c96a18715d49f89c3caca0d7
• https://git.kernel.org/stable/c/2bd20245dd658789d8cccb37697967b4caba6ad8
• https://git.kernel.org/stable/c/30d7fea767e830bd81ac2f73d2e33c877cb2e679
• https://git.kernel.org/stable/c/8a60ade2277e1f0e0d0578d565354e52292fa46d
• https://git.kernel.org/stable/c/d4fd251e3311727c32af89344d3332f788c153a2
• https://git.kernel.org/stable/c/e8f9979286f70dfbfe0552e2a63000950841bea6
• https://git.kernel.org/stable/c/f476fb656ca2326d7b2eba98d03ced1cbcf5cd99

• Infinite loop in Linux kernel sched
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more