CVE-2026-98021

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: reject oversized tx_queue_len at netlink parse time

rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len

without going through netif_change_tx_queue_len(), so a device created

with "ip link add ... txqueuelen 500000" bypasses the S16_MAX cap and

still triggers the oversized ring allocations in pfifo_fast, tun and

tap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the

RTM_NEWLINK-on-existing-device path reach the same sinks.

Enforce the cap in ifla_policy instead: IFLA_TXQLEN becomes

NLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with

txqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers

parse against this policy - rtnl_setlink(), rtnl_newlink() (create

and change), and the veth peer nest - so every netlink path is capped

at parse time and rejects the attribute with -ERANGE plus a proper

"integer out of range" extack message before any device state is

modified (the RTM_SETLINK h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References