CVE-2026-98021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98021", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.069Z", "datePublished": "2026-09-25T10:23:41.505Z", "dateUpdated": "2026-10-21T12:54:05.196Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:05.196Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: reject oversized tx_queue_len at netlink parse time\n\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\n\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\n\nDocument the bound in the rt-link.yaml netlink spec.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\n ip link add v0 txqueuelen 500000 type veth peer name v1\n -> on the fixed kernel this is rejected with -ERANGE (\"integer out\n of range\" extack) instead of installing an oversized tx_queue_len\n that later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/rt-link.yaml", "net/core/rtnetlink.c"], "versions": [{"version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "lessThan": "26ee5f99ffe7ab98e635071290eff14192e9e34a", "status": "affected", "versionType": "git"}, {"version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "lessThan": "45ca9f59b6c7ea70e0a17054902b8a556913db34", "status": "affected", "versionType": "git"}, {"version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "lessThan": "2fd0880f0272ec022906a05587fd91416ebecc38", "status": "affected", "versionType": "git"}, {"version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "lessThan": "a638a2625aa83160a394abe8e8b2e524a80c771b", "status": "affected", "versionType": "git"}, {"version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "lessThan": "1aa9e143bf51405665a793d4cc925e1c4f0c5922", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/rt-link.yaml", "net/core/rtnetlink.c"], "versions": [{"version": "2.6.23", "status": "affected"}, {"version": "0", "lessThan": "2.6.23", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/26ee5f99ffe7ab98e635071290eff14192e9e34a"}, {"url": "https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34"}, {"url": "https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38"}, {"url": "https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b"}, {"url": "https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}], "title": "net: reject oversized tx_queue_len at netlink parse time", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/rt-link.yaml", "net/core/rtnetlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "26ee5f99ffe7ab98e635071290eff14192e9e34a", "status": "affected", "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "versionType": "git"}, {"lessThan": "45ca9f59b6c7ea70e0a17054902b8a556913db34", "status": "affected", "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "versionType": "git"}, {"lessThan": "2fd0880f0272ec022906a05587fd91416ebecc38", "status": "affected", "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "versionType": "git"}, {"lessThan": "a638a2625aa83160a394abe8e8b2e524a80c771b", "status": "affected", "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "versionType": "git"}, {"lessThan": "1aa9e143bf51405665a793d4cc925e1c4f0c5922", "status": "affected", "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/rt-link.yaml", "net/core/rtnetlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.23"}, {"lessThan": "2.6.23", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: reject oversized tx_queue_len at netlink parse time\n\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\n\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\n\nDocument the bound in the rt-link.yaml netlink spec.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\n ip link add v0 txqueuelen 500000 type veth peer name v1\n -> on the fixed kernel this is rejected with -ERANGE (\"integer out\n of range\" extack) instead of installing an oversized tx_queue_len\n that later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time."}], "id": "CVE-2026-98021", "lastModified": "2026-10-21T13:21:19.287", "metrics": {}, "published": "2026-09-25T11:17:30.613", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26ee5f99ffe7ab98e635071290eff14192e9e34a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: reject oversized tx_queue_len at netlink parse time", "id": "2541299", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541299"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: reject oversized tx_queue_len at netlink parse time\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\nDocument the bound in the rt-link.yaml netlink spec.\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\nip link add v0 txqueuelen 500000 type veth peer name v1\n-> on the fixed kernel this is rejected with -ERANGE (\"integer out\nof range\" extack) instead of installing an oversized tx_queue_len\nthat later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time.", "A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink (rtnetlink) interface, the kernel fails to validate and enforce maximum limits on the transmission queue length (tx_queue_len) attribute. An attacker, including an unprivileged user inside a user namespace, can exploit this issue by requesting an excessively large queue length value, leading to oversized buffer allocations that exhaust system memory."], "name": "CVE-2026-98021", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98021\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98021\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98021.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[38f7b870d4a6a5d3ec21557e849620cb7d032965, 45ca9f59b6c7ea70e0a17054902b8a556913db34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[38f7b870d4a6a5d3ec21557e849620cb7d032965, 2fd0880f0272ec022906a05587fd91416ebecc38)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[38f7b870d4a6a5d3ec21557e849620cb7d032965, a638a2625aa83160a394abe8e8b2e524a80c771b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[38f7b870d4a6a5d3ec21557e849620cb7d032965, 1aa9e143bf51405665a793d4cc925e1c4f0c5922)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.23"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.23)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:15:14.511205+00:00", "updated": "2026-09-30T15:30:14.868110+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}