EUVD-2026-64350
GHSA-qwcm-6g6c-27vm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Stack exhaustion reliably causes kernel panic (A:H); confidentiality and integrity impact require exploiting the overflow past STACKPROTECTOR, which is not confirmed.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject overly deep qdisc hierarchies
Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent.
Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.
AnalysisAI
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access and the CAP_NET_ADMIN capability in the relevant network namespace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects realistic exploitation parameters - local access with low privilege - and the C:H/I:H/A:H triple-high impact suggests the vendor or NVD believes this is a privilege escalation vector, not just a crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with access to a shell on the target system - or an attacker who has gained code execution in a container using rootless/user-namespace mode - uses 'tc qdisc add' in a tight loop to iteratively graft child qdiscs, building a hierarchy far deeper than the kernel's stack can safely recurse. When the kernel subsequently traverses the hierarchy (e.g., during a 'tc qdisc show' or qdisc deletion), recursion depth causes a kernel stack overflow, resulting in at minimum a kernel panic and potentially exploitable memory corruption. … |
| Remediation | Upgrade to a patched Linux kernel version: 6.1.183 or later for the 6.1 stable branch, 6.6.152 or later for 6.6, 6.12.104 or later for 6.12, 6.18.45 or later for 6.18, 7.1.9 or later for 7.1, or 7.2 for the mainline branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running vulnerable kernel versions and determine which have processes or users with CAP_NET_ADMIN capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today