CVE-2026-90053
Low risk· EPSS 11%Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel, htb_classify() in net/sched/sch_htb did not bound the number of hops between HTB inner classes selected by filters. A filter on an inner class can point back to itself or form a cycle, causing an infinite loop in the packet classification path with the qdisc lock held and BH disabled — a single packet triggers a soft lockup or kernel panic. The fix introduces a hop counter bounded by TC_HTB_MAXDEPTH and drops the packet with a rate-limited warning once the limit is exceeded.
Risk Assessment
An unprivileged user able to obtain CAP_NET_ADMIN (e.g. via unshare -Urn) can send a single packet to hang or reboot the system, causing a denial of service. On systems with softlockup_panic=1 this results in an immediate kernel panic.
Recommendation
Update the Linux kernel to a version containing the fix that bounds the hop count in htb_classify(). Until patched, consider restricting unprivileged user namespace creation and disabling softlockup_panic.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
- CVE-2026-99251Unknown
In the Linux kernel, init_vp_index() contains a retry loop that strips CPUs from a node if they are already in the allocated cpumask or outside the HK_TYPE_MANAGED_IRQ housekeeping cpumask. If the housekeeping cpumask contains no CPU in that node, the loop becomes infinite. The fix skips NUMA nodes with no housekeeping CPU and aborts early when no online housekeeping CPUs exist.
- CVE-2026-99250Unknown
In the Linux kernel, the NBCON console printing kthreads are started very early during boot via early_initcall(). Asynchronously enabling/disabling interrupts during early boot may interfere with early SMP setup on some hardware platforms, causing hangs. The fix postpones kthread startup until after all arch initcalls have completed.
- CVE-2026-99249Unknown
In the Linux kernel, zap_pid_ns_processes() waiting for PID namespace cleanup was not freezable. A tracer outside the namespace that does not reap its traced zombies keeps PIDs allocated, making the wait unbounded and causing every suspend attempt to fail. The fix makes the wait loops use TASK_FREEZABLE states so the freezer can freeze waiting tasks.
- CVE-2026-99248Unknown
In the Linux kernel, the i2c: xiic driver was changed to restore non-managed runtime PM instead of the devres-based approach to fix a clk WARN flood. The managed release tore down runtime PM in the wrong order, causing the clock to be disabled twice and triggering "clkN already disabled" warnings on every teardown.
- CVE-2026-99247Unknown
In the Linux kernel, if trace buffer allocation fails during early boot, tracing_disabled remains set and the global trace array events list stays uninitialized. tracer_init_tracefs_work_func() runs asynchronously without checking this state and calls event_trace_init() and init_tracer_tracefs(), leading to a NULL pointer dereference Oops during boot. The fix checks tracing_disabled at the start of the work function.
- CVE-2026-99215Unknown
In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-class filter hops htb_classify() follows each filter-selected inner class by switching to cl->filter_list, but never bounds the number of hops. A filter on an inner class can point back to itself or to another inner class that points back, creating an infinite loop in the packet classification path with the qdisc lock held and BH disabled — a soft lockup / panic from a single packet. Bound the traversal with a hop counter and drop the packet with a rate-limited warning once the bound is exceeded. The counter is incremented at the point the inner filter chain is picked up, after the TC_ACT_* switch has consumed the classifier verdict, so a terminal TC_ACT_QUEUED/STOLEN/TRAP on the last permitted chain still sets *qerr to __NET_XMIT_STOLEN and the packet is not charged as a drop by this qdisc or its parent. The bound is TC_HTB_MAXDEPTH, taken from HTB's own parameters rather than from the qdisc hierarchy depth limit. Class levels run from 0 to TC_HTB_MAXDEPTH - 1, so a traversal that strictly descends in level can take at most TC_HTB_MAXDEPTH hops. That descent is what a sane configuration does, but it is assumed here rather than enforced: htb_find() resolves a classid against every class in the qdisc, so a filter may equally select a sibling or an ancestor. The normal root -> inner -> leaf path takes a single hop, so the bound does not affect legitimate classification. htb_classify() can now return NULL irrespective of CONFIG_NET_CLS_ACT, whereas previously every NULL return sat inside that ifdef. The NULL handler in htb_enqueue() therefore cannot stay conditional either, so drop the ifdef around it. This matches hfsc_enqueue(), which has always handled a NULL class unconditionally. Without it, a kernel built without actions would dereference a NULL class instead of dropping. Conditions to recreate the bug: - CONFIG_NET_SCHED, CONFIG_NET_SCH_HTB, CONFIG_NET_CLS_U32, CONFIG_LOCKUP_DETECTOR. - Create an HTB qdisc on a device (e.g. lo), add an inner class 1:1 with a leaf child 1:10, install a root u32 filter selecting 1:1, and an inner-class u32 filter on 1:1 also selecting 1:1. - Send one packet (ping). On the unfixed kernel the classify loop spins with the qdisc lock held; with softlockup_panic=1 it panics. - Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS