CVE-2026-98427

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the selftests patch).

• https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398
• https://git.kernel.org/stable/c/bacd72289d34d8c05b7de5a12448b87b6dd93878

Published

Oct 14, 2026

Last Modified

Oct 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98421In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98422In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98423In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98424In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98425In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98426In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98428In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98429In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9843The Database for Contact Form 7, WPforms, Elementor forms pl…8.1
• CVE-2026-98430In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98431In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98432In the Linux kernel, the following vulnerability has been re…