CVE-2026-74663: Linux Kernel Qdisc Hierarchy DoS Vulnerability

CVE-2026-74663 Overview

CVE-2026-74663 is a Linux kernel vulnerability in the net/sched subsystem. Deep queueing discipline (qdisc) hierarchies trigger excessive recursion in qdisc tree walkers, exhausting the kernel stack. The existing loop check does not cover the create-and-graft path, allowing a local attacker to extend a hierarchy by creating a new child qdisc under an already deep parent. Successful exploitation leads to kernel stack exhaustion and system compromise from a local, low-privileged context.

Critical Impact
A local user with the ability to configure network queueing disciplines can exhaust the kernel stack through recursive qdisc tree walks, producing denial of service and potential memory corruption affecting confidentiality, integrity, and availability.

Affected Products

Linux kernel net/sched subsystem (mainline, prior to fix commits)
Stable kernel branches referenced by the upstream fix commits
Distributions shipping vulnerable kernels that expose qdisc configuration to unprivileged or containerized workloads

Discovery Timeline

2026-08-22 - CVE-2026-74663 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74663

Vulnerability Analysis

The Linux traffic control layer represents qdiscs as a tree of nodes attached to network devices. Multiple tree walkers traverse this structure recursively during configuration, dumping, and packet scheduling operations. When the hierarchy grows deep, recursion depth grows with it and consumes finite kernel stack space.

The subsystem previously included a loop check to prevent cycles. That check does not guard the create-and-graft code path, which attaches a newly created child qdisc to an existing parent. An attacker can iteratively add children beneath the deepest node, extending the tree past safe limits. Once any tree walker traverses the resulting hierarchy, recursion overflows the kernel stack.

The fix stores the hierarchy depth in struct Qdisc and updates it on graft. New child qdiscs are rejected once the parent already sits at the maximum allowed depth.

Root Cause

The root cause is missing depth enforcement in the qdisc create-and-graft path. The kernel tracked no per-qdisc depth counter, so recursion-heavy walkers relied on implicit tree shape. Any code path that could extend the tree without validating depth constituted a stack exhaustion primitive.

Attack Vector

Exploitation requires local access with permission to configure network qdiscs, typically CAP_NET_ADMIN within a user or network namespace. Unprivileged user namespaces on many distributions expose this capability to ordinary users. The attacker issues repeated tc qdisc add operations that graft new children under progressively deeper parents until a walker overflows the stack.

See the upstream fixes for technical details: Linux Kernel Commit 08dc49d, Linux Kernel Commit 2759acf, and Linux Kernel Commit a627d36.

Detection Methods for CVE-2026-74663

Indicators of Compromise

Kernel oops or panic messages referencing stack overflow in qdisc walker functions such as qdisc_tree_reduce_backlog, qdisc_graft, or qdisc_lookup.
Bursts of tc qdisc add netlink activity from a single process or container establishing many parent-child relationships in short succession.
Unexpected termination of processes making RTM_NEWQDISC netlink requests followed by network namespace instability.

Detection Strategies

Audit AUDIT_NETFILTER_CFG and netlink NETLINK_ROUTE events for high-frequency qdisc creation from non-administrative accounts or containers.
Correlate kernel ring buffer entries (dmesg) containing stack traces in net/sched/sch_api.c with the originating process and namespace.
Baseline expected qdisc topology per host and alert on hierarchies exceeding a small depth threshold.

Monitoring Recommendations

Ship /var/log/kern.log and audit logs to a centralized analytics platform for correlation across hosts and containers.
Track process ancestry for callers of the tc binary and any program using AF_NETLINK sockets with NETLINK_ROUTE.
Monitor for repeated segfaults or panics on kernels that predate the upstream fix commits listed above.

How to Mitigate CVE-2026-74663

Immediate Actions Required

Apply the kernel update from your distribution vendor that incorporates the upstream fix commits.
Inventory hosts running kernels that predate the fix and prioritize multi-tenant, container, and namespace-heavy environments.
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces where operationally acceptable until patched.

Patch Information

The upstream resolution adds a depth field to struct Qdisc, maintains it on graft operations, and rejects new children once the maximum allowed depth is reached. Fix commits are available upstream: 08dc49d, 2759acf, 8ca8cdb, 9f69bb9, a4b14a4, a627d36, dedd34b, and e2d658c. Rebuild affected kernels and reboot systems after installation.

Workarounds

Set kernel.unprivileged_userns_clone=0 (or the equivalent distribution sysctl) to prevent unprivileged users from obtaining CAP_NET_ADMIN inside new namespaces.
Constrain container runtimes to drop NET_ADMIN from workloads that do not require traffic control configuration.
Apply seccomp or AppArmor/SELinux policies that block the tc binary and direct netlink qdisc manipulation for untrusted users.

bash

# Configuration example
# Disable unprivileged user namespaces (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/60-userns.conf

# Drop NET_ADMIN from container workloads (Docker)
docker run --cap-drop=NET_ADMIN <image>

# Verify running kernel and reboot after patching
uname -r