Description
In the Linux kernel, the following vulnerability has been resolved:

net/sched: codel: bound the dropping loop per dequeue call

The CoDel control law schedules the next drop one interval/sqrt(count)
after the previous drop, using the configured interval
(codel_params.interval). For very small intervals the scheduled step
rounds down to zero, so the dropping loop in codel_dequeue() never
advances and drains the entire backlog under the qdisc lock in one
call - an unprivileged user can trigger a soft lockup this way.

Fix in the shared codel code used by both codel and fq_codel:

1. Make the control-law step at least 1 tick so the dropping loop
always moves forward.

2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops
per codel_dequeue() call, resyncing drop_next to now when the cap
is hit: the catch-up owed to the loop grows with the idle gap and
the backlog, which no interval threshold can bound. This is a
deliberate behaviour change after long idle gaps.

The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path
(fixed interval, cap only).

The target sojourn delay (codel_params.target) is not validated: it
does not feed the control law, so a sub-tick value is aggressive
rather than deadlock-prone.

Conditions to recreate the bug:
- tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000
- tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel)
- unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf
soft-lockups (watchdog: BUG: soft lockup) while one
codel_dequeue() call drops the backlog under the qdisc lock
- patched kernel: same setup, at most 256 drops per dequeue call,
no soft lockup

Testing: claim reproducer and interval 2us/3us variants run clean;
tdc qdisc category passes (see the selftests patch).
Published: 2026-10-14
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (soft lockup)
Action: Patch Immediately
AI Analysis

Impact

The Linux kernel CoDel queuing discipline contains a bug that allows an unprivileged user to configure a very small CoDel interval and flood traffic, which causes the drop‑scheduling logic to calculate a zero step, draining the entire backlog in one qdisc lock acquisition and triggering a kernel soft lockup that renders the system unresponsive.

Affected Systems

All Linux kernel releases that use the legacy CoDel implementation are affected; this includes any kernel prior to the patch commit that bounds the dropping loop, so administrators should assume kernels before that commit are vulnerable.

Risk and Exploitability

The defect can be exploited by an attacker who can configure a qdisc and send traffic; the EPSS score of less than 1% indicates a low probability of automated exploitation, and the vulnerability is not recorded in CISA KEV, implying no confirmed exploits. The impact is a local denial of service manifested as a kernel soft lockup, potentially halting system responsiveness. The CVSS base score is 5.5, reflecting moderate severity.

Generated by OpenCVE AI on October 16, 2026 at 22:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a Linux kernel version that includes the CoDel dropping‑loop fix (any kernel after commit 7f4a5ec).
  • If an immediate update is not possible, avoid configuring codel intervals smaller than one tick; use a larger interval or disable codel/fq_codel on queues that handle critical traffic.
  • Configure access controls or limit the ability to run 'tc' so that only privileged users can alter qdisc settings.
  • Monitor kernel logs for a "watchdog: BUG: soft lockup" message and, if detected, temporarily remove or modify the offending qdisc while troubleshooting.

Generated by OpenCVE AI on October 16, 2026 at 22:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-835
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Thu, 15 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Thu, 15 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Wed, 14 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the selftests patch).
Title net/sched: codel: bound the dropping loop per dequeue call
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:19:21.452Z

Reserved: 2026-09-25T10:25:14.348Z

Link: CVE-2026-98427

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T14:17:54.343

Modified: 2026-10-19T10:18:49.313

Link: CVE-2026-98427

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98427 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T19:00:04Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')