Bug 2521389 (CVE-2026-74663)

Summary: CVE-2026-74663 kernel: net/sched: reject overly deep qdisc hierarchies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel. An attacker could create overly deep queueing discipline (qdisc) hierarchies, leading to excessive recursion in qdisc tree walkers. This can exhaust the kernel stack, resulting in a Denial of Service (DoS) due to a system crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-22 15:43:08 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject overly deep qdisc hierarchies

Deep qdisc hierarchies can lead to excessive recursion in qdisc tree
walkers and exhaust the kernel stack. The existing loop check does not
cover the create-and-graft path, so a hierarchy can still be extended by
creating a new child qdisc below an already deep parent.

Store the hierarchy depth in struct Qdisc and update it when qdiscs are
grafted. Reject new child qdiscs once the parent is already at the maximum
allowed depth.
Comment 1 gkamathe 2026-08-24 10:54:57 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74663-88a3@gregkh/T