CVE-2026-98567 - Vulnerability Details

- net: xps: reject an out of range traffic class

Description

In the Linux kernel, the following vulnerability has been resolved:

net: xps: reject an out of range traffic class

Only the entries below dev->num_tc are valid in dev->tc_to_txq[], and
dev->prio_tc_map[] may only name classes below it. netdev_set_num_tc()
lowers dev->num_tc without touching either array.

netdev_txq_to_tc() walks all TC_MAX_QUEUE slots and
netdev_get_prio_tc_map() returns the entry as it stands, so a leftover
entry is handed out as a traffic class >= dev->num_tc. Taking that
class from netdev_txq_to_tc(), __netif_set_xps_queue() rejects only a
negative one and indexes an XPS map sized for dev->num_tc classes:

tci = j * num_tc + tc;
RCU_INIT_POINTER(new_dev_maps->attr_map[tci], map);

attr_map[] holds nr_ids * num_tc entries and j runs over the ids named
in the mask, so a class that is not below num_tc pushes tci past the end
of the map for the last ids and the store overruns it.

Any caller that lowers num_tc leaves such entries behind, and
mqprio_destroy() tears down with netdev_set_num_tc(dev, 0) rather than
netdev_reset_tc(). After mqprio with 8 classes then 1, tc_to_txq[1..7]
still describe txq 1..7. The splat is from an XPS write to txq 2 on a
veth with 8 rx queues: attr_map[] has 8 * 1 entries, tci = j + 2, and
j == 6 stores one past the end of the 88-byte map:

BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue (net/core/dev.c:2954)
Write of size 8 at addr ffff88813016bc58 by task xps_oob/634
__netif_set_xps_queue (net/core/dev.c:2954)
xps_rxqs_store (net/core/net-sysfs.c:1880)
netdev_queue_attr_store (net/core/net-sysfs.c:1390)
Allocated by task 634:
__kmalloc_noprof (mm/slub.c:5439)
__netif_set_xps_queue (net/core/dev.c:2937)
The buggy address is located 0 bytes to the right of
allocated 88-byte region [ffff88813016bc00, ffff88813016bc58)

Reject a class the map has no room for.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is in the Linux kernel’s XPS subsystem where lowering a device’s number of traffic classes without clearing associated mappings allows an out‑of‑bounds write to the XPS attribute map. This corrupts kernel memory and can be overwritten with arbitrary data, potentially enabling a local attacker to manipulate system behavior or cause a crash.

Affected Systems

Linux kernel, all releases that support XPS traffic class configuration until the patch is applied. The issue resides in the netdev_set_num_tc, netdev_txq_to_tc, and __netif_set_xps_queue code paths and can be triggered via sysfs entries under /sys/class/net/*/queues/*.

Risk and Exploitability

The description suggests the vulnerability could be triggered through sysfs writes or manipulation of network interface attributes. The kernel memory corruption indicates a potentially serious impact. The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. No public exploit is known. Further assessment is recommended.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 967e10f40a0c6732db299cbe001df0e859196055
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 1cb8e40525a72c9f1e1cf94c68c172b3b9bbdc81
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 6ea8f643053f33622f9116e4e1db58306ece45e3
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 9e841723ba482d41ecbf90241c756a16cdfea949
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< eff227a3cb4d0089fbb85c73480bf8abf2e5ae7f
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 2cc1c3977acbffc417fb5b57699d1df3dcffb5fd
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 930318290d8509e864c015fe6c9239470b3c579c
`184c449f91fef521042970cca46bd5cdfc0e3a37`	affected	< 4da3b7b8b50f3e2fde54a4c18a82a8e3f6223910

Linux

affected

Version	Status	Constraints
`4.10`	affected	—
`0`	unaffected	< 4.10
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[184c449f91fef521042970cca46bd5cdfc0e3a37,967e10f40a0c6732db299cbe001df0e859196055)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,1cb8e40525a72c9f1e1cf94c68c172b3b9bbdc81)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,6ea8f643053f33622f9116e4e1db58306ece45e3)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,9e841723ba482d41ecbf90241c756a16cdfea949)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,eff227a3cb4d0089fbb85c73480bf8abf2e5ae7f)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,2cc1c3977acbffc417fb5b57699d1df3dcffb5fd)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,930318290d8509e864c015fe6c9239470b3c579c)`	affected	code_commit	—
`[184c449f91fef521042970cca46bd5cdfc0e3a37,4da3b7b8b50f3e2fde54a4c18a82a8e3f6223910)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.10`	affected	generic	—
`[0,4.10)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	generic	—
`[5.15.222,5.16.0)`	unaffected	generic	—
`[6.1.189,6.2.0)`	unaffected	generic	—
`[6.6.158,6.7.0)`	unaffected	generic	—
`[6.12.112,6.13.0)`	unaffected	generic	—
`[6.18.55,6.19.0)`	unaffected	generic	—
`[7.2.9,7.3.0)`	unaffected	generic	—
`[7.3-rc5,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates the fix for the XPS out-of-range traffic class issue.
Restrict write access to the sysfs devices that configure XPS, ensuring only root or appropriately privileged users can modify /sys/class/net/*/queues/* attributes.
If possible, disable XPS or limit any affected network interface to a single traffic class so that the out‑of‑range class cannot be selected.

Generated by OpenCVE AI on October 20, 2026 at 16:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98567.mbox
https://git.kernel.org/stable/c/1cb8e40525a72c9f1e1cf94c68c172b3b9bbdc81
https://git.kernel.org/stable/c/2cc1c3977acbffc417fb5b57699d1df3dcffb5fd
https://git.kernel.org/stable/c/4da3b7b8b50f3e2fde54a4c18a82a8e3f6223910
https://git.kernel.org/stable/c/6ea8f643053f33622f9116e4e1db58306ece45e3
https://git.kernel.org/stable/c/930318290d8509e864c015fe6c9239470b3c579c
https://git.kernel.org/stable/c/967e10f40a0c6732db299cbe001df0e859196055
https://git.kernel.org/stable/c/9e841723ba482d41ecbf90241c756a16cdfea949
https://git.kernel.org/stable/c/eff227a3cb4d0089fbb85c73480bf8abf2e5ae7f
https://nvd.nist.gov/vuln/detail/CVE-2026-98567
https://www.cve.org/CVERecord?id=CVE-2026-98567

History

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98567.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98567 https://www.cve.org/CVERecord?id=CVE-2026-98567
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 23:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev->num_tc are valid in dev->tc_to_txq[], and dev->prio_tc_map[] may only name classes below it. netdev_set_num_tc() lowers dev->num_tc without touching either array. netdev_txq_to_tc() walks all TC_MAX_QUEUE slots and netdev_get_prio_tc_map() returns the entry as it stands, so a leftover entry is handed out as a traffic class >= dev->num_tc. Taking that class from netdev_txq_to_tc(), __netif_set_xps_queue() rejects only a negative one and indexes an XPS map sized for dev->num_tc classes: tci = j * num_tc + tc; RCU_INIT_POINTER(new_dev_maps->attr_map[tci], map); attr_map[] holds nr_ids * num_tc entries and j runs over the ids named in the mask, so a class that is not below num_tc pushes tci past the end of the map for the last ids and the store overruns it. Any caller that lowers num_tc leaves such entries behind, and mqprio_destroy() tears down with netdev_set_num_tc(dev, 0) rather than netdev_reset_tc(). After mqprio with 8 classes then 1, tc_to_txq[1..7] still describe txq 1..7. The splat is from an XPS write to txq 2 on a veth with 8 rx queues: attr_map[] has 8 * 1 entries, tci = j + 2, and j == 6 stores one past the end of the 88-byte map: BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue (net/core/dev.c:2954) Write of size 8 at addr ffff88813016bc58 by task xps_oob/634 __netif_set_xps_queue (net/core/dev.c:2954) xps_rxqs_store (net/core/net-sysfs.c:1880) netdev_queue_attr_store (net/core/net-sysfs.c:1390) Allocated by task 634: __kmalloc_noprof (mm/slub.c:5439) __netif_set_xps_queue (net/core/dev.c:2937) The buggy address is located 0 bytes to the right of allocated 88-byte region [ffff88813016bc00, ffff88813016bc58) Reject a class the map has no room for.
Title		net: xps: reject an out of range traffic class
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1cb8e40525a72c9f1e1cf94c68c172b3b9bbdc81 https://git.kernel.org/stable/c/2cc1c3977acbffc417fb5b57699d1df3dcffb5fd https://git.kernel.org/stable/c/4da3b7b8b50f3e2fde54a4c18a82a8e3f6223910 https://git.kernel.org/stable/c/6ea8f643053f33622f9116e4e1db58306ece45e3 https://git.kernel.org/stable/c/930318290d8509e864c015fe6c9239470b3c579c https://git.kernel.org/stable/c/967e10f40a0c6732db299cbe001df0e859196055 https://git.kernel.org/stable/c/9e841723ba482d41ecbf90241c756a16cdfea949 https://git.kernel.org/stable/c/eff227a3cb4d0089fbb85c73480bf8abf2e5ae7f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:33.721Z

Updated: 2026-10-19T09:21:52.909Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98567

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:08.870

Modified: 2026-10-19T10:19:14.597

Link: CVE-2026-98567

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98567 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T17:00:18Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object