In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: clamp quantum in change and init paths
hhf_change() accepts any quantum from userspace, including 1. With a crafted size table qdisc_pkt_len reaches ~2 GiB, so quantum=1 makes the deficit-refill loop spin ~2^31 times under the qdisc lock (a soft lockup / denial of service).
Add max(256U, ...) in hhf_change() matching fq_codel_change(). Clamp hhf_init() to [256, 1<<20] matching the siblings, and remove the old fallback that only set quantum=256 on overflow.
Conditions to recreate the bug: CONFIG_NET_SCH_HHF=y. Requires CAP_NET_ADMIN (namespace-local via unshare -Urn suffices).
tc qdisc add dev dummy0 root hhf tc qdisc change dev dummy0 root hhf quantum 1 stab data 32768 size_log 15 cell_log 0
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade microvm-kernel6.18Upgrade bpftool6.18-debuginfoUpgrade kernel-tools-develUpgrade bpftool6.12Upgrade kernel-livepatch-6.12.111-136.204Upgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel6.18-tools-develUpgrade perf6.18Upgrade python3-perf6.18Upgrade bpftoolUpgrade kernel6.18-develUpgrade microvm-kernelUpgrade kernel6.18-toolsUpgrade kernel6.18-debuginfoUpgrade perf6.12Upgrade kernel6.18-headersUpgrade kernel6.18-modules-extraUpgrade python3-perfUpgrade python3-perf6.12-debuginfoUpgrade kernelUpgrade kernel6.18-tools-debuginfoUpgrade kernel-livepatch-6.1.189-236.399Upgrade kernel-headersUpgrade bpftool6.18Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade perfUpgrade kernel6.12-toolsUpgrade kernel6.12-headersUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-livepatch-6.18.54-121.166Upgrade kernel6.12-develUpgrade kernel-develUpgrade kernel6.18Upgrade python3-perf6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12Upgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.12-tools-develUpgrade kernel6.12-modules-extraUpgrade python3-perf6.18-debuginfoUpgrade perf-debuginfoUpgrade kernel6.18-modules-extra-commonUpgrade kernel-modules-extraUpgrade bpftool6.12-debuginfoUpgrade bpftool-debuginfo | Oct 13, 2026 | Sep 25, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 30, 2026 | Sep 25, 2026 |
| Redhat_linux | — | No solution exists | Sep 30, 2026 | Sep 25, 2026 |
| Ubuntu | — | Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcpUpgrade linux-ibmUpgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-fipsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-realtimeUpgrade linux-riscv-5.15Upgrade linux-bluefieldUpgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.15Upgrade linux-hwe-7.0Upgrade linux-awsUpgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-aws-5.15Upgrade linux-intel-iotg-5.15Upgrade linuxUpgrade linux-gkeopUpgrade linux-riscvUpgrade linux-oracle-5.15Upgrade linux-gkeUpgrade linux-azure-fdeUpgrade linux-riscv-7.0Upgrade linux-oem-7.0Upgrade linux-nvidia-tegra-5.15Upgrade linux-azure-fde-5.15Upgrade linux-azureUpgrade linux-lowlatencyUpgrade linux-azure-fipsUpgrade linux-nvidia-tegraUpgrade linux-oracle | Nov 3, 2026 | Sep 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Sep 25, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub