EUVD-2026-103655

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610

The Linux kernel contains a vulnerability in the net/sched: sch_hfsc component where the classify inner-filter walk is unbounded. When hfsc_adjust_levels() raises a class level without revalidating existing bindings, it can create a cycle between two interior classes. During classification, the s...