CoDel Scheduling Vulnerability in Linux Kernel Affecting Unprivileged Users

CVE-2026-98427

What is CVE-2026-98427?

A vulnerability in the Linux kernel's CoDel scheduling mechanism can allow unprivileged users to trigger soft lockups. The CoDel control law's drop scheduling mechanism, which dictates the interval between drops, can be manipulated under certain conditions. If configured with very small intervals, the loop responsible for managing drops may not progress, leading to excessive backlog and system instability. When the dropping loop is allowed to exceed a certain number of drops per dequeue call, the potential for soft lockup arises. The resolution involves ensuring that the drop step is capped and progresses forward to prevent the system from being overwhelmed. This improvement enhances the stability and reliability of the system under network loads.

References