CVE-2026-98567

In the Linux kernel, the following vulnerability has been resolved:

net: xps: reject an out of range traffic class

Only the entries below dev->num tc are valid in dev->tc to txq[], and dev->prio tc map[] may only name classes below it. netdev set num tc() lowers dev->num tc without touching either array.

netdev txq to tc() walks all TC MAX QUEUE slots and netdev get prio tc map() returns the entry as it stands, so a leftover entry is handed out as a traffic class >= dev->num tc. Taking that class from netdev txq to tc(), netif set xps queue() rejects only a negative one and indexes an XPS map sized for dev->num tc classes:

tci = j * num tc + tc;
RCU INIT POINTER(new dev maps->attr map[tci], map);

attr map[] holds nr ids * num tc entries and j runs over the ids named in the mask, so a class that is not below num tc pushes tci past the end of the map for the last ids and the store overruns it.

Any caller that lowers num tc leaves such entries behind, and mqprio destroy() tears down with netdev set num tc(dev, 0) rather than netdev reset tc(). After mqprio with 8 classes then 1, tc to txq[1..7] still describe txq 1..7. The splat is from an XPS write to txq 2 on a veth with 8 rx queues: attr map[] has 8 * 1 entries, tci = j + 2, and j == 6 stores one past the end of the 88-byte map:

BUG: KASAN: slab-out-of-bounds in netif set xps queue (net/core/dev.c:2954) Write of size 8 at addr ffff88813016bc58 by task xps oob/634 netif set xps queue (net/core/dev.c:2954) xps rxqs store (net/core/net-sysfs.c:1880) netdev queue attr store (net/core/net-sysfs.c:1390) Allocated by task 634: kmalloc noprof (mm/slub.c:5439) netif set xps queue (net/core/dev.c:2937) The buggy address is located 0 bytes to the right of allocated 88-byte region [ffff88813016bc00, ffff88813016bc58)

Reject a class the map has no room for.