CVE-2026-98010
Description
A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network packet scheduler. This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS) by configuring a traffic class with an unconstrained low quantum value. When processed with large packet lengths, this issue causes the deficit refill mechanism to loop excessively while holding a lock, leading to a system lockup.
Statement
A low impact denial of service flaw was found in the Linux kernel's Deficit Round Robin (DRR) network packet scheduler (net/sched/sch_drr.c). When creating or changing a DRR class, drr_change_class() rejects an explicit quantum of 0 but falls back to psched_mtu() without enforcing a minimum value. A local user with CAP_NET_ADMIN privileges in a network namespace, which an unprivileged local user can obtain through unprivileged user namespaces when they are enabled, can configure a traffic class with a very small quantum value. Combined with large packet lengths, for example from a crafted size table, this makes the deficit refill loop iterate excessively while holding the qdisc lock, consuming the CPU and causing a system lockup. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 (Extended Lifecycle Support) and Red Hat Enterprise Linux 8, as well as the Red Hat Enterprise Linux 8 based CoreOS image shipped with OpenShift Container Platform 4.12. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL CoreOS 9 are not affected because the vulnerable code is not present in those versions. Exploitation requires local access with network administration privileges and the impact is limited to availability, with no effect on confidentiality or integrity; for this reason Red Hat rates the impact of this flaw as Low, although the CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Moderate). A fix for the affected Red Hat Enterprise Linux 7 and 8 based offerings is deferred given the low severity of the flaw and the privilege level required to trigger it; the residual risk is that a local user who holds CAP_NET_ADMIN in a network namespace can hang the affected system.
Mitigation
Exploitation requires the ability to configure queueing disciplines, which is limited to users holding CAP_NET_ADMIN in a network namespace. To prevent unprivileged local users from acquiring namespace-local CAP_NET_ADMIN through unprivileged user namespaces, user namespace creation can be disabled by setting the sysctl user.max_user_namespaces to 0 (for example with 'sysctl -w user.max_user_namespaces=0', persisted in /etc/sysctl.d/). Note that this can affect functionality that relies on user namespaces, such as containers, and it does not prevent the issue from being triggered by users who already hold CAP_NET_ADMIN on the host or in an existing network namespace.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
