---
id: CVE-2023-53624
title: 'net/sched: sch_fq: fix integer overflow of "credit"'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: sch_fq: fix integer overflow of "credit"

  if sch_fq is configured with "initial quantum" having values greater than
  INT_MAX, the first assignment of "credit"…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    4b8a05e3801661a0438fcd0cdef181030d966a5a
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    d0b43125ec892aeb1b03e5df5aab595097da225a
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    4fbefeab88c6e79753a25099d455d3d59d2946b4
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd
  - >-
    Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc <
    7041101ff6c3073fd8f2e99920f535b111c929cb
  - Linux 3.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:26:02.351789Z'
published: '2025-10-07'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:18.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53624'
references:
  - url: 'https://git.kernel.org/stable/c/4b8a05e3801661a0438fcd0cdef181030d966a5a'
  - url: 'https://git.kernel.org/stable/c/d0b43125ec892aeb1b03e5df5aab595097da225a'
  - url: 'https://git.kernel.org/stable/c/4fbefeab88c6e79753a25099d455d3d59d2946b4'
  - url: 'https://git.kernel.org/stable/c/85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad'
  - url: 'https://git.kernel.org/stable/c/2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd'
  - url: 'https://git.kernel.org/stable/c/7041101ff6c3073fd8f2e99920f535b111c929cb'
tags:
  - cve.org
epss: 0.00208
epssPercentile: 0.11034
ingestedAt: '2026-11-05T22:38:31.820Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_fq: fix integer overflow of "credit"

if sch_fq is configured with "initial quantum" having values greater than
INT_MAX, the first assignment of "credit" does signed integer overflow to
a very negative value.
In this situation, the syzkaller script provided by Cristoph triggers the
CPU soft-lockup warning even with few sockets. It's not an infinite loop,
but "credit" wasn't probably meant to be minus 2Gb for each new flow.
Capping "initial quantum" to INT_MAX proved to fix the issue.

v2: validation of "initial quantum" is done in fq_policy, instead of open
    coding in fq_change() _ suggested by Jakub Kicinski

## Affected

- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4b8a05e3801661a0438fcd0cdef181030d966a5a`
- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < d0b43125ec892aeb1b03e5df5aab595097da225a`
- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4fbefeab88c6e79753a25099d455d3d59d2946b4`
- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad`
- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd`
- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 7041101ff6c3073fd8f2e99920f535b111c929cb`
- `Linux 3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.