Linux Kernel Daily: Packet Scheduler Denial-of-Service Fixes

Two independent security researchers surfaced soft-lockup bugs in the traffic control subsystem this cycle, both fixed by bounding attacker-controlled loops in the queueing discipline code, alongside a networking pull that folded in a raft of long-standing fixes across Bluetooth, SCTP, and Ethernet drivers.

Duration: PT2M25S

Episode overview

This episode is a short developer briefing from Linux Kernel Daily.

It explains recent repository work in plain language.

  • Show: Linux Kernel Daily
  • Published: 2026-08-28T06:02:46Z
  • Audio duration: PT2M25S

Transcript excerpt

This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.

Good day. It's August 28th, 2026, and this is Linux Kernel Daily.

The standout pattern today is packet scheduler hardening. Two separate commits, both credited to reports from the same external researcher, close soft-lockup holes where a crafted or self-referential configuration could spin the kernel forever under a held lock.

In commit eight-f-seven-three-five-d, Jamal Hadi Salim caps queueing discipline packet length. A crafted size table could inflate a packet's accounted length to nearly a gigabyte, and deficit-round-robin style schedulers replenish their quota one unit at a time — so a tiny quantum combined with that inflated length…

The second, commit seven-two-nine-c-four-eight-nine, targets the hierarchical token bucket scheduler. A filter on an inner class could point back to itself, creating an infinite classification loop with the lock held and interrupts disabled. The fix adds a hop counter bounded by the scheduler's own max depth, so…

A related fix, commit d5dc1e6, closes a different class of problem: GSO metadata leaking into IP fragments from tun and tap devices. A reassembled fragment could still claim to be a GSO packet, and handing that to the segmentation code…

Beyon…

Nearby episodes from Linux Kernel Daily

  1. The Late Merge Window Cleanup Wave
  2. The Merge Window Closes on Race Conditions and Resource Leaks
  3. The Merge Window Opens for 7.3
  4. Weekly Recap - Merge Window Hardening Across Subsystems
  5. The Merge Window Marathon
  6. A Merge Window Full of Race Condition Fixes
  7. The Merge Window Closes Out
  8. The Merge Window Lands