CVE-2026-74663

net/sched: reject overly deep qdisc hierarchies

HIGH
7.8
CVSS Score
Published: August 22, 2026 at 03:32 PM UTC
Updated: October 16, 2026 at 08:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent. Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Vendor states this is fixed in 08dc49df1527b09d9ea225a7265bbf6c237097bf (fixed)
Vendor states this is fixed in 2759acf08a3454866660edcd3ef4e64139f254a6 (fixed)
Vendor states this is fixed in 8ca8cdb74939581339e1ae370193c0adb5a85336 (fixed)
Vendor states this is fixed in 9f69bb9fdaa2fe64b68bb62fb84d405784bee540 (fixed)
Vendor states this is fixed in a4b14a4df29d36458a943f9b521ddd0f940363cc (fixed)
Vendor states this is fixed in a627d36c2a94e18c8c105ae68008786dfd85592e (fixed)
Vendor states this is fixed in dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 (fixed)
Vendor states this is fixed in e2d658c6427844cee5bc654b436ca68d680b6148 (fixed)
Vendor states this is fixed in 2.6.12 (unaffected)
Vendor states this is fixed in 5.10.267 (unaffected)
Vendor states this is fixed in 5.15.218 (unaffected)
Vendor states this is fixed in 6.1.183 (unaffected)
Vendor states this is fixed in 6.12.104 (unaffected)
Vendor states this is fixed in 6.18.45 (unaffected)
Vendor states this is fixed in 6.6.152 (unaffected)
Vendor states this is fixed in 7.1.9 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card