In the Linux kernel, following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period no range check yet, and this can be used to trigger a race condition fixed in separate patch. We want make sure ctl->perturb_period * HZ will not overflow and is positive. tc qd add dev lo root sfq -10 # negative value : error Error: period. tc 1000000000 too big 2000000 acceptable value tc -s -d sh lo qdisc 8005: refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 2000000sec Sent 0 bytes pkt (dropped 0, overlimits requeues 0) backlog 0b 0p