CVE-2026-90076

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fq init() function where quantum and initial quantum are computed using psched mtu() without overflow checks. When a device has an excessively large Maximum Transmission Unit (MTU), the resulting 32-bit arithmetic multiplications can wrap to zero, setting q->quantum to 0. Subsequently, the credit-refill loop in the fq dequeue() function adds 0 to f->credit, causing an infinite loop under the qdisc lock, which leads to a soft lockup. This condition can be triggered by a device with a sufficiently large MTU and requires CAP NET ADMIN privileges within a user namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.