CVE-2026-90058

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the network scheduler where the qdisc get stab() function accepts a user-supplied size table. The qdisc calculate pkt len() function can amplify the qdisc pkt len() value through overhead, size-table data, and size log. A specially crafted size table can set qdisc pkt len() to approximately 1 GiB for a standard socket buffer (skb). Per-flow deficit schedulers, such as DRR and ETS, replenish one quantum per loop iteration; if a tiny quantum of 1 is used, the system may spin billions of times under the qdisc lock, resulting in a soft lockup or RCU stall. This is reachable by root or an unprivileged user in a new user and network namespace with CAP NET ADMIN privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.