CVE-2026-74663

The Linux kernel can accept user‑defined traffic control hierarchies called qdiscs. An attacker may construct a hierarchy that is excessively deep; each traversal of the tree triggers recursive function calls that consume the kernel stack. Previously the kernel’s loop check did not consider the create‑and‑graft path, allowing a new qdisc to be added underneath an already deep parent and thus extending the depth beyond the programmed limit. The fix implements depth tracking in the qdisc structure and rejects any child that would exceed the maximum permitted depth, preventing kernel stack exhaustion and service interruption.

All Linux kernel implementations that support the network scheduler and allow users to create qdisc trees are affected. The CVE description does not list specific kernel versions, so the vulnerability applies to current releases until the depth‑check patch is applied.

Exploiting this flaw requires the ability to configure qdiscs via the netlink interface, which is normally restricted to processes with CAP_NET_ADMIN or root privileges; therefore the likely attack vector is local privileged or a compromised privileged process. The CVSS score of 7.8 indicates a high severity, and the EPSS score is less than 1%, meaning the current exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog, yet the potential for a full system crash makes the risk significant. The vulnerability does not grant code execution but can cause a denial of service by exhausting the kernel stack through recursive qdisc traversal.