CVE-2026-98022

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations

Several subsystems allocate ring buffers sized by dev->tx_queue_len

with no upper bound. An unprivileged user (via unshare -Urn) can set a

huge tx_queue_len and exhaust global memory with ring allocations:

- pfifo_fast: pfifo_fast_init() and pfifo_fast_change_tx_queue_len()

allocate 3 skb_array rings of tx_queue_len entries each.

- tun: tun_queue_resize() and the queue-attach path resize ptr_rings

to tx_queue_len on the NETDEV_CHANGE_TX_QUEUE_LEN notifier.

- tap (macvtap/ipvtap): tap_queue_resize() and tap_init() resize/init

ptr_rings to tx_queue_len on the same notifier.

netif_change_tx_queue_len() is the single entry point for IFLA_TXQLEN,

sysfs, and the SIOCSIFTXQLEN ioctl. Cap new_len at S16_MAX (32767)

there so the oversized value is rejected at set time. This takes

effect whether the device is up or down, before dev->tx_queue_len is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References