CVE-2026-98610 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use the HFSC scheduler should assess their exposure to this vulnerability. They should review and update the Linux kernel to the latest version, verify HFSC scheduler configuration for potential vulnerabilities, and monitor the system for soft lockup events.

Why it matters

This vulnerability can cause a soft lockup in the Linux kernel's HFSC scheduler, leading to a denial of service and potential system crashes or freezes. Linux kernel developers and administrators should assess their exposure and take steps to mitigate the vulnerability.

• Denial of Service (DoS) via soft lockup
• Potential for system crashes or freezes
• Increased risk of security breaches due to unprivileged user access

Technical summary

The Linux kernel's HFSC scheduler has a soft lockup vulnerability. When a filter with a flowid is created and bound to a class, and later the class's level is raised without revalidating existing bindings, it can lead to an infinite loop in the classify walk. This can cause a soft lockup, which can be triggered by a single packet and is reachable from an unprivileged user via unshare -Urn (CAP_NET_ADMIN). The bug was fixed by bounding the traversal with a budget of non-descending hops.

Defensive priority

Medium

Recommended defensive actions

• Review and update Linux kernel to the latest version
• Verify HFSC scheduler configuration for potential vulnerabilities
• Monitor system for soft lockup events
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was introduced in the Linux kernel and can be triggered by a specific configuration of the HFSC scheduler. The conditions to recreate the bug require a cycle with two legal-at-bind-time flowid binds and a level drift. The bug was fixed by bounding the traversal with a budget of non-descending hops.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.