CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98010

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

CVE-2026-98013

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: clamp quantum in change path fqpiechange accepts any quantum value from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

CVE-2026-98011

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

DEBIAN-CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

AZL-104640 CVE-2026-97959 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

DEBIAN-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

AZL-104682 CVE-2026-97958 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

DEBIAN-CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

AZL-104505 CVE-2026-97616 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

UBUNTU-CVE-2026-98087

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

UBUNTU-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

UBUNTU-CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

UBUNTU-CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

UBUNTU-CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

UBUNTU-CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

UBUNTU-CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...