CVE-2026-98021
Received Received - Intake

Linux Kernel tx_queue_len Integer Overflow Fix

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: reject oversized tx_queue_len at netlink parse time rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len without going through netif_change_tx_queue_len(), so a device created with "ip link add ... txqueuelen 500000" bypasses the S16_MAX cap and still triggers the oversized ring allocations in pfifo_fast, tun and tap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the RTM_NEWLINK-on-existing-device path reach the same sinks. Enforce the cap in ifla_policy instead: IFLA_TXQLEN becomes NLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with txqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers parse against this policy - rtnl_setlink(), rtnl_newlink() (create and change), and the veth peer nest - so every netlink path is capped at parse time and rejects the attribute with -ERANGE plus a proper "integer out of range" extack message before any device state is modified (the RTM_SETLINK half-application wart is gone with it). Document the bound in the rt-link.yaml netlink spec. Conditions to recreate the bug: - CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y. - Unprivileged user in a fresh user+net namespace (unshare -Urn): ip link add v0 txqueuelen 500000 type veth peer name v1 -> on the fixed kernel this is rejected with -ERANGE ("integer out of range" extack) instead of installing an oversized tx_queue_len that later inflates pfifo_fast/tun/tap ring allocations. - ip link set v0 txqueuelen 500000 is likewise rejected at parse time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-98021
EUVD
EUVD-2026-86674

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel allows an unprivileged user to set an excessively large tx_queue_len value (e.g., 500000) when creating or modifying network devices via netlink. This bypasses the S16_MAX cap and triggers oversized ring allocations in components like pfifo_fast, tun, and tap, potentially causing memory exhaustion or system instability.

Detection Guidance

To detect this vulnerability, check if any network device has an excessively large tx_queue_len value. Run: ip link show. Look for values exceeding S16_MAX (32767). If any device shows a txqueuelen larger than this, it may be vulnerable.

Impact Analysis

An attacker could exploit this to cause denial-of-service by allocating excessive memory for network device queues, leading to system crashes or resource exhaustion. It requires specific kernel configurations and unprivileged user access in a fresh namespace.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a Linux kernel issue where oversized tx_queue_len values bypass size limits, potentially causing resource exhaustion. Compliance impacts would only occur if this vulnerability led to system instability or denial of service in environments handling sensitive data.

Mitigation Strategies

Update your Linux kernel to a patched version that enforces the tx_queue_len cap. If you cannot update immediately, manually set tx_queue_len to a safe value (e.g., 1000) using: ip link set dev <device> txqueuelen 1000.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart