{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-98021",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-25T10:19:56.069Z",
        "datePublished": "2026-09-25T10:23:41.505Z",
        "dateUpdated": "2026-10-21T12:54:05.196Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-21T12:54:05.196Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: reject oversized tx_queue_len at netlink parse time\n\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\n\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\n\nDocument the bound in the rt-link.yaml netlink spec.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\n  ip link add v0 txqueuelen 500000 type veth peer name v1\n  -> on the fixed kernel this is rejected with -ERANGE (\"integer out\n  of range\" extack) instead of installing an oversized tx_queue_len\n  that later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "Documentation/netlink/specs/rt-link.yaml",
                        "net/core/rtnetlink.c"
                    ],
                    "versions": [
                        {
                            "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965",
                            "lessThan": "26ee5f99ffe7ab98e635071290eff14192e9e34a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965",
                            "lessThan": "45ca9f59b6c7ea70e0a17054902b8a556913db34",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965",
                            "lessThan": "2fd0880f0272ec022906a05587fd91416ebecc38",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965",
                            "lessThan": "a638a2625aa83160a394abe8e8b2e524a80c771b",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "38f7b870d4a6a5d3ec21557e849620cb7d032965",
                            "lessThan": "1aa9e143bf51405665a793d4cc925e1c4f0c5922",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "Documentation/netlink/specs/rt-link.yaml",
                        "net/core/rtnetlink.c"
                    ],
                    "versions": [
                        {
                            "version": "2.6.23",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "2.6.23",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.160",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.111",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.53",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.7",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.23",
                                    "versionEndExcluding": "6.6.160"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.23",
                                    "versionEndExcluding": "6.12.111"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.23",
                                    "versionEndExcluding": "6.18.53"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.23",
                                    "versionEndExcluding": "7.2.7"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.23",
                                    "versionEndExcluding": "7.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/26ee5f99ffe7ab98e635071290eff14192e9e34a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34"
                },
                {
                    "url": "https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b"
                },
                {
                    "url": "https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"
                }
            ],
            "title": "net: reject oversized tx_queue_len at netlink parse time",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}