CVE-2026-74663
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject overly deep qdisc hierarchies
Deep qdisc hierarchies can lead to excessive recursion in qdisc tree
walkers and exhaust the kernel stack. The existing loop check does not
cover the create-and-graft path, so a hierarchy can still be extended by
creating a new child qdisc below an already deep parent.
Store the hierarchy depth in struct Qdisc and update it when qdiscs are
grafted. Reject new child qdiscs once the parent is already at the maximum
allowed depth.
CSIRTS triage
- What
- A denial of service vulnerability in the network scheduler (qdisc) that allows creation of excessively deep queue discipline hierarchies.
- Who is affected
- Systems running affected Linux kernel versions where unprivileged users can configure qdisc rules.
- Urgency
- Medium priority; not exploited but allows local denial of service through resource exhaustion.
- Action
- Apply Linux kernel patch rejecting overly deep qdisc hierarchies during configuration.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-74663
Get an email if CVE-2026-74663 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-74663)