CVE-2026-98567

What it actually does

Out-of-bounds write in __netif_set_xps_queue when an invalid traffic class >= num_tc is used to index attr_map after netdev_set_num_tc lowers the count without clearing dev->tc_to_txq or prio_tc_map, allowing writes past the allocated map sized for num_tc classes.

Why it matters to the business

Kernel memory corruption on Linux systems using XPS queue steering with mqprio or veth devices can cause crashes, data corruption, or potential privilege escalation; low EPSS and absence from KEV indicate limited active exploitation risk five days after disclosure.

How an attack unfolds

An attacker configures mqprio with multiple traffic classes then reduces to fewer classes leaving stale entries, followed by writing to XPS attributes via net-sysfs which triggers __netif_set_xps_queue to compute an out-of-bounds tci and perform an uncontrolled store into the undersized attr_map.

How to fix it

Apply the upstream fix that rejects traffic classes outside the current num_tc range in netdev_txq_to_tc and netdev_get_prio_tc_map; rebuild and deploy the patched kernel; prefer netdev_reset_tc over netdev_set_num_tc(0) in teardown paths such as mqprio_destroy.

How to confirm the fix worked

Verify the patch is present by inspecting net/core/dev.c around netdev_txq_to_tc and __netif_set_xps_queue for the added bounds check; reproduce the KASAN splat on an unpatched kernel using veth with 8 queues and mqprio followed by XPS write; confirm absence of slab-out-of-bounds after upgrade.

Typical attack path

1. Lower num_tc via netdev_set_num_tc without resetting tc_to_txq or prio_tc_map
2. Invoke xps_rxqs_store or equivalent sysfs write referencing a stale high traffic class
3. Compute tci = j * num_tc + tc where tc >= num_tc and j reaches the last id
4. Perform RCU_INIT_POINTER write one past the end of the kmalloc'd attr_map

How to detect it

Search kernel logs for KASAN slab-out-of-bounds messages referencing __netif_set_xps_queue and net/core/dev.c:2954; inspect sysfs writes to /sys/class/net/*/queues/ that coincide with mqprio configuration changes; review audit logs for processes writing XPS attributes after TC reconfiguration.

• BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue
• Write of size 8 at addr .* by task xps_oob
• net/core/dev.c:2954
• xps_rxqs_store

What your security team should do

• Monitor for kernel updates addressing this buffer overflow and schedule deployment within normal change windows given low EPSS
• Audit custom or third-party drivers that call netdev_set_num_tc and ensure they use netdev_reset_tc for full teardown
• Add KASAN or kernel memory debugging to test environments that exercise XPS and mqprio configurations