CVE-2026-90074

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A signed overflow occurs in the fq pie init() function when the default quantum is set using psched mtu() without clamping. On devices with an exceptionally large Maximum Transmission Unit (MTU), psched mtu() can return a value that overflows the signed flow->deficit variable to INT MIN within the fq pie qdisc dequeue() function. This leads to an infinite loop and a soft lockup. Exploitation requires CAP NET ADMIN privileges within a user namespace and a device where the MTU plus hard header length wraps into the sign bit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.