Vulnerability details
CVE-2026-74663
Linux Linux
net/sched: reject overly deep qdisc hierarchies
CVSS 3.1
7.8High
Official description
In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent. Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (Linux) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Linux | Linux | 2.6.12 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < a627d36c2a94e18c8c105ae68008786dfd85592e | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 9f69bb9fdaa2fe64b68bb62fb84d405784bee540 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 8ca8cdb74939581339e1ae370193c0adb5a85336 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 08dc49df1527b09d9ea225a7265bbf6c237097bf | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < a4b14a4df29d36458a943f9b521ddd0f940363cc | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < e2d658c6427844cee5bc654b436ca68d680b6148 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 2759acf08a3454866660edcd3ef4e64139f254a6 | CVEProject cvelistV5 (CNA) |
References and advisories
8- https://git.kernel.org/stable/c/08dc49df1527b09d9ea225a7265bbf6c237097bf
- https://git.kernel.org/stable/c/a627d36c2a94e18c8c105ae68008786dfd85592e
- https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540
- https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336
- https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6
- https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc
- https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148
- https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-22
- Last updated
- 2026-10-16
- State
- Published
- Assigner (CNA)
- Linux
Exploit prediction (EPSS)
0.12%
Probability of exploitation in 30 days
2.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- —