CVE-2026-98012

A low impact denial of service flaw was found in the Linux kernel's Stochastic Fairness Queueing (SFQ) network packet scheduler (net/sched/sch_sfq.c). The sfq_change() function did not properly clamp the user-controlled quantum parameter, accepting any non-negative value. A local attacker with CAP_NET_ADMIN privileges, which can also be obtained inside an unprivileged user namespace via 'unshare -Urn', can combine a very small quantum value with a crafted packet size table so that qdisc_pkt_len reaches roughly 2 GiB, causing the deficit-refill loop to iterate approximately 2^31 times while holding the qdisc lock. This results in a kernel soft lockup and denial of service of the affected system; confidentiality and integrity are not impacted. Although the CVSS:3.1 base score is 5.5 (Moderate) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Red Hat rated the impact of this flaw as Low because exploitation requires local access with CAP_NET_ADMIN and the consequence is limited to a CPU soft lockup. The vulnerable code is present only in Red Hat Enterprise Linux 9.8.z, 9.9, and 9.10, Red Hat Enterprise Linux 10.2.z, 10.3, and 10.4, Red Hat In-Vehicle OS 2.0.z and 2.1 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (RHEL CoreOS 9 kernel); these streams are marked for a deferred fix. Older Red Hat Enterprise Linux 7 and 8 streams, the RHEL 9.2, 9.4, and 9.6.z and RHEL 10.0.z update streams, kernel-rt streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in them. Because the fix is deferred to a future update, the residual risk remains a local denial of service by an attacker who holds CAP_NET_ADMIN privileges.