CVE-2026-74663 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent. Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth.

Is your site exposed to CVE-2026-74663?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0013

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/08dc49df1527b09d9ea225a7265bbf6c237097bf https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6 https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336 https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540 https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc https://git.kernel.org/stable/c/a627d36c2a94e18c8c105ae68008786dfd85592e https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148

Frequently Asked Questions

What is CVE-2026-74663? +

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be extended by creating a new child qdisc below an already deep parent. Store the hierarchy depth in struct Qdisc and update it when qdiscs are grafted. Reject new child qdiscs once the parent is already at the maximum allowed depth. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-74663? +

CVE-2026-74663 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0013, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-74663? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-74663