CVE-2026-98567: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98567 Overview

CVE-2026-98567 is a Linux kernel vulnerability in the Transmit Packet Steering (XPS) subsystem. The flaw lets a local user trigger a slab out-of-bounds write in __netif_set_xps_queue() by writing to xps_rxqs on a network device whose traffic class count was lowered without clearing stale tc_to_txq[] entries. KASAN reports the overflow as a one-slot write past an 88-byte allocation. The bug surfaces on paths such as mqprio_destroy(), which calls netdev_set_num_tc(dev, 0) instead of netdev_reset_tc(), leaving leftover traffic class metadata.

Critical Impact
A local user with permission to configure XPS on a network device can trigger a kernel slab out-of-bounds write, enabling denial of service and potential memory corruption.

Affected Products

Linux kernel (upstream net/core/dev.c XPS code path)
Distributions shipping kernels prior to the fix commits referenced by kernel.org stable
Systems using mqprio qdisc or other callers that lower dev->num_tc

Discovery Timeline

2026-10-18 - CVE-2026-98567 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98567

Vulnerability Analysis

The vulnerability is a slab out-of-bounds write [CWE-787] in the Linux kernel networking core. XPS maps transmit queues to traffic classes using the arrays dev->tc_to_txq[] and dev->prio_tc_map[]. Only entries below dev->num_tc are valid.

When netdev_set_num_tc() lowers dev->num_tc, it does not clear the two arrays. Later, netdev_txq_to_tc() iterates all TC_MAX_QUEUE slots and may return a traffic class index greater than or equal to dev->num_tc. __netif_set_xps_queue() rejects only negative values before computing tci = j * num_tc + tc. Because attr_map[] is sized for nr_ids * num_tc entries, a stale tc value pushes tci past the end of the allocation.

The reproducer in the commit log sets mqprio with 8 classes, reconfigures to 1 class, then writes XPS for txq 2 on a veth with 8 receive queues. attr_map[] holds 8 * 1 entries, tci = j + 2, and j == 6 stores 8 bytes one slot past the 88-byte region.

Root Cause

The root cause is incomplete state teardown. netdev_set_num_tc() reduces the traffic class count without resetting tc_to_txq[] or prio_tc_map[]. Callers such as mqprio_destroy() rely on this helper rather than the complete netdev_reset_tc(), leaving stale entries that violate the invariant assumed by XPS code.

Attack Vector

Exploitation requires local access with the capability to configure a network device, typically CAP_NET_ADMIN in the relevant namespace. An attacker configures mqprio with multiple traffic classes, lowers the class count, and writes to a sysfs XPS attribute such as xps_rxqs on an affected queue. The resulting out-of-bounds write corrupts adjacent slab memory and can crash the kernel.

The fix in the referenced kernel.org stable commits rejects any traffic class the XPS map has no room for, preventing the overrun. See the kernel.org stable commits for the exact patch content across backport branches.

Detection Methods for CVE-2026-98567

Indicators of Compromise

KASAN splat slab-out-of-bounds in __netif_set_xps_queue in dmesg or kernel ring buffer
Kernel oops or panic following writes to /sys/class/net/<dev>/queues/tx-*/xps_rxqs or xps_cpus
Unexpected mqprio reconfiguration events followed by XPS sysfs writes from unprivileged workloads with elevated namespace capabilities

Detection Strategies

Monitor kernel logs for KASAN or BUG reports naming __netif_set_xps_queue, xps_rxqs_store, or netdev_queue_attr_store
Audit tc qdisc changes that transition mqprio from multiple classes to a lower class count on production hosts
Alert on sysfs writes to XPS attributes from containers or user sessions that do not normally tune network queues

Monitoring Recommendations

Enable kernel crash reporting (kdump, systemd-coredump) to capture oops traces for post-incident analysis
Forward /dev/kmsg or journald kernel messages to a central log store and alert on KASAN strings
Track installed kernel versions across the fleet and flag hosts running pre-patch builds

How to Mitigate CVE-2026-98567

Immediate Actions Required

Apply the latest stable kernel update from your distribution that includes the referenced upstream commits
Restrict CAP_NET_ADMIN inside user namespaces and containers where untrusted workloads run
Audit workloads that reconfigure mqprio and ensure they do not run alongside untrusted tenants on unpatched kernels

Patch Information

The upstream fix rejects traffic classes that exceed the XPS map size. Backports are available in multiple stable branches. See the kernel.org stable commits: 1cb8e40, 2cc1c39, 4da3b7b, 6ea8f64, 9303182, 967e10f, 9e84172, and eff227a.

Workarounds

Avoid lowering mqprio traffic class counts on affected kernels; use netdev_reset_tc()-equivalent teardown by removing and recreating devices
Prevent unprivileged users from writing to xps_rxqs and xps_cpus sysfs attributes by tightening file permissions or using LSM policies
Disable user namespaces for untrusted workloads if operational policy allows

bash

# Verify kernel version includes the fix and inspect XPS sysfs permissions
uname -r
ls -l /sys/class/net/<iface>/queues/tx-*/xps_rxqs
# Disable unprivileged user namespaces (Debian/Ubuntu example)
sysctl -w kernel.unprivileged_userns_clone=0