net/sched: fq: clamp quantum and initial_quantum in change path
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initial_quantum in change path The fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and TCA_FQ_INITIAL_QUANTUM up to INT_MAX, while fq_init() already clamps to [1, 1<<20]. A user can override the init clamp via tc qdisc change, restoring the small-quantum deficit spin that the init clamp prevents. Narrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected at parse time. Clamp TCA_FQ_QUANTUM to [256, 1<<20] in fq_change() and fq_init() quantum to [256, 1<<20] for tiny-MTU devices. Conditions to recreate the bug: CONFIG_NET_SCH_FQ=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices). tc qdisc add dev dummy0 root fq tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 size_log 15 cell_log 0
CVE-2026-90050
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-90050
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d16dac3925be95ad46e986d4b139c9898b6e227f"
},
{
"fixed": "a27498d34c3f429fb6db3aa609569f8154afa175"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f6b3e3848a5fca63438984acd6d9eceac80814c1"
},
{
"fixed": "798283cd0fe7ba997f67e5a917f14ab40afa8d9f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e35acd56f244d94355f9ab237c2ecc8fba5e6f04"
},
{
"fixed": "72e9387884554f47b03bfd40fb8b2bf52789c68d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "709f34f7c28dc4dd6c40343d101850f11e172312"
},
{
"fixed": "094cc07f98dfe70a34e2a1923af17fd29b8cf622"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90050.json"
}
}
]- Related CVEs
- CVE-2026-90050
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #17841 · Revision 1
- Added to Heist Feed
- Publisher date