CVE-2026-98797

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: cap skb->queue_mapping when the tx queue is picked

skbedit can set skb->queue_mapping and raise the per-CPU skip_txqueue

flag so __dev_queue_xmit() honours the mapping. __dev_queue_xmit()

cleared the flag before sch_handle_egress() and only read it afterwards,

so the flag was not confined to the xmit that set it: a nested xmit

(mirred redirect or mirror, or a drop after skbedit) could set the flag

and the outer xmit would consume it for an skb that never went through

skbedit.

A forwarded packet still carries the ingress NIC's rx_queue + 1 in

skb->queue_mapping, so the outer device then indexes its tx queue state

with that stale value. Taprio's child array q->qdiscs[] is sized to the

device's queue count, so taprio_enqueue() indexes past its allocation

and dereferences the result as a struct Qdisc *.

We (ab)use the skb->nf_skip_egress which means "skip netfilter egress

for this packet" to tag to "am I in tc egr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References