CVE-2026-98567

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: xps: reject an out of range traffic class

Only the entries below dev->num_tc are valid in dev->tc_to_txq[], and

dev->prio_tc_map[] may only name classes below it. netdev_set_num_tc()

lowers dev->num_tc without touching either array.

netdev_txq_to_tc() walks all TC_MAX_QUEUE slots and

netdev_get_prio_tc_map() returns the entry as it stands, so a leftover

entry is handed out as a traffic class >= dev->num_tc. Taking that

class from netdev_txq_to_tc(), __netif_set_xps_queue() rejects only a

negative one and indexes an XPS map sized for dev->num_tc classes:

tci = j * num_tc + tc;

RCU_INIT_POINTER(new_dev_maps->attr_map[tci], map);

attr_map[] holds nr_ids * num_tc entries and j runs over the ids named

in the mask, so a class that is not below num_tc pushes tci past the end

of the map for the last ids and the store overruns it.

Any caller that lowers num_tc leaves such entries behind, and

mqprio_destroy() tears

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References