Cloudanix VulnDB

CVE-2026-98427

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network traffic scheduler can let an attacker freeze the system by sending data through specially configured queues.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unbounded dropping loop in codel_dequeue under qdisc lock when control-law step rounds to zero for sub-tick intervals, allowing one call to drain entire backlog and trigger soft lockup.

Why it matters to the business

Systems using codel or fq_codel qdiscs with small configured intervals can become unresponsive under moderate traffic, causing denial of service and potential kernel watchdog resets.

How an attack unfolds

Attacker configures a qdisc with a very small interval (e.g., 2us) on an interface, applies a rate limiter, then sends a UDP flood that forces repeated dequeue calls; the loop never advances and holds the lock until soft lockup.

How to fix it

Upgrade to a kernel containing the shared codel fix that enforces a minimum 1-tick step and caps drops at CODEL_MAX_DROPS_PER_DEQUEUE (256) per dequeue call; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel source or binary includes the codel loop bound changes; run the published reproducer tc commands plus UDP flood and verify no soft lockup occurs and at most 256 drops per dequeue.

Typical attack path

  1. Configure tbf + codel/fq_codel qdisc with sub-tick interval via tc
  2. Generate UDP flood traffic under the rate limit
  3. Trigger repeated codel_dequeue calls that execute unbounded drops
  4. Induce soft lockup watchdog panic

How to detect it

Search kernel logs for watchdog soft lockup messages mentioning codel_dequeue, net/sched, or qdisc lock contention; correlate with network interface configurations containing unusually small codel intervals.

What your security team should do

  • Prioritize kernel upgrade on all systems exposing network interfaces to untrusted traffic
  • Audit existing qdisc configurations for interval values below one tick
  • Enable kernel watchdog and monitor for soft lockup messages in dmesg/syslog
  • Test patched kernels with tdc qdisc selftests before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the selftests patch).

Affected packages

Ecosystem Package Introduced Fixed