{"id":"CVE-2026-98567","kind":"vulnerability","aliases":["CVE-2026-98567"],"related":[],"title":"Linux kernel: out-of-range XPS traffic class overruns memory in network transmit setup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xps: reject an out of range traffic class\n\nOnly the entries below dev->num_tc are valid in dev->tc_to_txq[], and\ndev->prio_tc_map[] may only name classes below it. netdev_set_num_tc()\nlowers dev->num_tc without touching either array.\n\nnetdev_txq_to_tc() walks all TC_MAX_QUEUE slots and\nnetdev_get_prio_tc_map() returns the entry as it stands, so a leftover\nentry is handed out as a traffic class >= dev->num_tc. Taking that\nclass from netdev_txq_to_tc(), __netif_set_xps_queue() rejects only a\nnegative one and indexes an XPS map sized for dev->num_tc classes:\n\n\ttci = j * num_tc + tc;\n\tRCU_INIT_POINTER(new_dev_maps->attr_map[tci], map);\n\nattr_map[] holds nr_ids * num_tc entries and j runs over the ids named\nin the mask, so a class that is not below num_tc pushes tci past the end\nof the map for the last ids and the store overruns it.\n\nAny caller that lowers num_tc leaves such entries behind, and\nmqprio_destroy() tears down with netdev_set_num_tc(dev, 0) rather than\nnetdev_reset_tc(). After mqprio with 8 classes then 1, tc_to_txq[1..7]\nstill describe txq 1..7. The splat is from an XPS write to txq 2 on a\nveth with 8 rx queues: attr_map[] has 8 * 1 entries, tci = j + 2, and\nj == 6 stores one past the end of the 88-byte map:\n\n  BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue (net/core/dev.c:2954)\n  Write of size 8 at addr ffff88813016bc58 by task xps_oob/634\n   __netif_set_xps_queue (net/core/dev.c:2954)\n   xps_rxqs_store (net/core/net-sysfs.c:1880)\n   netdev_queue_attr_store (net/core/net-sysfs.c:1390)\n  Allocated by task 634:\n   __kmalloc_noprof (mm/slub.c:5439)\n   __netif_set_xps_queue (net/core/dev.c:2937)\n  The buggy address is located 0 bytes to the right of\n   allocated 88-byte region [ffff88813016bc00, ffff88813016bc58)\n\nReject a class the map has no room for.","summary":"After the number of traffic classes is lowered, stale per-queue entries can name a class beyond the valid range. Writing an XPS queue mapping then stores past the end of an allocated map, a kernel memory corruption that a local user with access to the queue sysfs settings may be able to trigger.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mqprio","networking","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: xps: reject an out of range traffic class'\n- unknown","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:17+00:00","updated_at":"2026-10-25T05:23:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:23:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: xps: reject an out of range traffic class'\n- unknown","reach":"local","title":"Linux kernel: out-of-range XPS traffic class overruns memory in network transmit setup","impact":"high","summary":"After the number of traffic classes is lowered, stale per-queue entries can name a class beyond the valid range. Writing an XPS queue mapping then stores past the end of an allocated map, a kernel memory corruption that a local user with access to the queue sysfs settings may be able to trigger.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","networking","mqprio","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel memory corruption, possibly privilege escalation, by a local user","analyst_note":"Confirm affected kernel version range and fixed commit from the NVD entry or the upstream kernel git log; the sources give no CVSS score or affected versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel where mqprio or another caller has lowered the traffic class count on a network device and XPS queue mappings are then written through sysfs. Systems that never use mqprio traffic classes or set XPS mappings on multi-queue devices are less likely to hit the path. The sources do not give the affected kernel version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4065,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98567':18A,21A '0':286C,409C '1':298C,302C,307C,330C '1390':389C '1880':383C '2':318C,334C '2937':403C '2954':361C,378C '5439':397C '6':337C '634':393C '7':303C,308C '8':295C,323C,329C,365C '88':345C,416C 'abl':83B 'access':75B 'addr':367C 'address':406C 'alloc':64B,390C,415C 'array':141C 'attr':217C,221C,326C,386C 'behind':274C 'beyond':48B 'bound':354C 'bug':348C 'buggi':405C 'byte':346C,410C,417C 'caller':266C 'class':9A,36B,47B,104C,127C,174C,180C,205C,241C,296C,423C 'corrupt':69B 'cve':16A,19A 'describ':305C 'destroy':277C 'dev':109C,115C,120C,135C,175C,202C,215C,285C 'either':140C 'end':61B,252C,342C 'entri':43B,107C,160C,167C,228C,273C,331C 'ffff88813016bc00':419C 'ffff88813016bc58':368C,420C 'follow':91C 'get':154C 'hand':169C 'hold':223C 'host':30B 'id':225C,234C,259C 'index':196C 'infrastructur':22B 'init':212C 'j':207C,230C,333C,336C 'kasan':349C 'kernel':2A,25B,67B,89C 'kmalloc':394C 'last':258C 'leav':271C 'leftov':166C 'linux':1A,24B,88C 'linux-kernel':23B 'local':72B 'locat':408C 'lower':38B,134C,268C 'map':56B,65B,123C,157C,199C,216C,218C,220C,222C,255C,327C,347C,425C 'mask':238C 'max':149C 'may':81B,124C 'memori':11A,68B 'mm/slub.c':396C 'mqprio':26B,276C,293C 'name':45B,126C,235C 'negat':193C 'net':96C 'net/core/dev.c':360C,377C,402C 'net/core/net-sysfs.c':382C,388C 'netdev':130C,142C,153C,182C,281C,289C,384C 'netif':186C,356C,373C,398C 'network':13A,27B 'new':214C 'noprof':395C 'nr':224C 'num':110C,132C,136C,176C,203C,208C,226C,246C,269C,283C 'number':33B 'one':194C,339C 'oob/634':372C 'out-of-rang':3A 'overrun':10A,263C 'past':59B,250C,340C 'per':41B 'per-queu':40B 'pointer':213C 'prio':121C,155C 'push':248C 'queue':42B,55B,78B,150C,189C,325C,359C,376C,385C,401C 'rang':6A,51B,102C 'rather':287C 'rcu':211C 'region':418C 'reject':98C,190C,421C 'reset':290C 'resolv':95C 'return':158C 'right':413C 'room':428C 'run':231C 'rx':324C 'rxqs':380C 'self':29B 'self-host':28B 'set':80B,131C,187C,282C,357C,374C,399C 'setup':15A 'size':200C,364C 'slab':351C 'slab-out-of-bound':350C 'slot':151C 'splat':310C 'stale':39B 'stand':163C 'still':304C 'store':58B,262C,338C,381C,387C 'sysf':79B 'take':178C 'task':370C,392C 'tc':111C,116C,122C,133C,137C,145C,148C,156C,177C,185C,204C,209C,210C,227C,247C,270C,284C,291C,299C 'tci':206C,219C,249C,332C 'tear':278C 'touch':139C 'traffic':8A,35B,103C,173C 'transmit':14A 'trigger':85B 'txq':118C,143C,183C,301C,306C,317C 'user':73B 'valid':50B,113C 'veth':321C 'vulner':92C 'walk':146C 'without':138C 'write':52B,315C,362C 'xps':7A,54B,97C,188C,198C,314C,358C,371C,375C,379C,400C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel where mqprio or another caller has lowered the traffic class count on a network device and XPS queue mappings are then written through sysfs. Systems that never use mqprio traffic classes or set XPS mappings on multi-queue devices are less likely to hit the path. The sources do not give the affected kernel version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98567","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}