CVE-2026-98797
N/AIn the Linux kernel, the following vulnerability has been resolved: net: cap skb->queue_mapping when the tx queue is picked skbedit can set skb->queue_mapping and raise the per-CPU skip_txqueue flag so __dev_queue_xmit() honours the mapping. __dev_queue_xmit() cleared the flag before sch_handle_egress() and only read it afterwards, so the flag was not confined to the xmit that set it: a nested xmit (mirred redirect or mirror, or a drop after skbedit) could set the flag and the outer xmit would consume it for an skb that never went through skbedit. A forwarded packet still carries the ingress NIC's rx_queue + 1 in skb->queue_mapping, so the outer device then indexes its tx queue state with that stale value. Taprio's child array q->qdiscs[] is sized to the device's queue count, so taprio_enqueue() indexes past its allocation and dereferences the result as a struct Qdisc *. We (ab)use the skb->nf_skip_egress which means "skip netfilter egress for this packet" to tag to "am I in tc egress?". Despite the overload I dont see it as a conflict since the marker is set only around the single sch_handle_egress() call and ingress path is guarded by tc_at_ingress. I will send a followup(net-next) patch once this hits net-next to rename the skb->nf_skip_egress bit/flag to skb->skip_egress Arm the flag only from the egress classifier that can use it: raise skip_txqueue from tcf_skbedit_act() only when it runs inside sch_handle_egress(), thanks to skb->nf_skip_egress. An egress qdisc classifier runs in q->enqueue(), after the tx queue has been picked, so a mapping it sets cannot affect the current packet; arming the flag there only pollutes it for a later xmit. Then own the flag for the xmit frame the egress hook runs in: save the incoming value and clear it just before sch_handle_egress(), and restore it after the hook - on the consumed (drop) path, or, in the same call that reads it, on the surviving path. The save and the restores stay inside the egress_needed_key static branch, so a packet pays for them only when egress hooks are active (2f1e85b1aee4). Store the value netdev_cap_txqueue() selected back into skb->queue_mapping in netdev_tx_queue_mapping(), as netdev_core_pick_tx() already does, so the skip_txqueue path never hands a later reader on the xmit path a mapping the device cannot serve. A store made still later in the same frame, by a tc BPF program attached to a transmit qdisc, is outside this path and is not re-capped; a separate followup will resolve that path. netdev_xmit_skip_txqueue() returns the previous flag value so the save-and-clear is one call, and a no-op stub is provided when CONFIG_NET_EGRESS is disabled. skb->nf_skip_egress is compiled under CONFIG_NET_EGRESS rather than CONFIG_NETFILTER_SKIP_EGRESS, so skb_at_tc_egress() is valid whenever the egress path is built. A local user in a network namespace can redirect a packet from a device with more TX queues to one with fewer after setting a mapping valid only on the larger device. That reaches these reads and, under KASAN, faults with "slab-out-of-bounds in taprio_enqueue". Conditions to recreate the bug: the report's own trigger is a local user with CAP_NET_ADMIN in a network namespace, so no eBPF program is needed. With CONFIG_NET_SCH_TAPRIO=y, CONFIG_NET_ACT_SKBEDIT=y, CONFIG_NET_ACT_MIRRED=y, CONFIG_NET_CLS_MATCHALL=y, CONFIG_NET_SCH_PRIO=y and KASAN enabled, create qa (3 queues), qb (2 queues) and qc (1 queue) as dummy devices; put a taprio root on qb (num_tc 1, queues 2@0) and clsact on all three; then add an egress matchall filter on every device. On qa: "action skbedit queue_mapping 2 pipe action mirred egress redirect dev qb". On qb: "action mirred egress mirror dev qc". On qc: "action skbedit queue_mapping 0 pipe". Send one packet out qa. qc's skbedit sets the flag while qb's outer xmit is in flight; without the fix qb consumes it and reads its two-entry taprio child array with the forwarded packet's stale mapping. A qc whose skb ---truncated---
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 5th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
References and research data (JSON)
Vendor product assessments
Showing 32 of 278 vendor product statements; 246 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- none available: Fix deferred
kernel-debug as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug
- none available: Fix deferred
kernel-rt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt
- none available: Fix deferred
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-kvm
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- none available: Fix deferred
kernel-doc as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-doc
- no fix planned: Out of support scope
kernel-debug-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-devel
- none available: Fix deferred
kernel-rt-debug-modules as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- none available: Fix deferred
kernel-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-extra
- none available: Fix deferred
kernel-debug-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-devel-matched
- none available: Fix deferred
kernel-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-internal
- none available: Fix deferred
kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-devel-matched
- none available: Fix deferred
kernel-rt-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-partner
- none available: Fix deferred
kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt-addons
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- none available: Fix deferred
bpftool as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-abi-whitelists as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-whitelists
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-kdump as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-devel
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt-kvm as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-kvm
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-trace-devel
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-rt.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt?arch=src
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools-libs-devel
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00perf as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8
Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98797.json Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103882 EUVD · EUVD-2026-103882
Technical & other
- https://git.kernel.org/stable/c/c6ec35c8267c84c2094cb485db20c06384fc2bccCVE record · Linux · Updated 2026-10-19T09:25:49.920Z
NVD · CVE-2026-98797 · Updated 2026-10-19T10:19:43.707 - https://git.kernel.org/stable/c/2f581814e4e3ea6a5e98f49813dc4c68444a0c4aCVE record · Linux · Updated 2026-10-19T09:25:49.920Z
NVD · CVE-2026-98797 · Updated 2026-10-19T10:19:43.707 - https://git.kernel.org/stable/c/f99de42f5c6f8d088063817dad82c3334e87c570CVE record · Linux · Updated 2026-10-19T09:25:49.920Z
NVD · CVE-2026-98797 · Updated 2026-10-19T10:19:43.707 - https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63dCVE record · Linux · Updated 2026-10-19T09:25:49.920Z
NVD · CVE-2026-98797 · Updated 2026-10-19T10:19:43.707 - https://access.redhat.com/security/cve/CVE-2026-98797 Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2555185 Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-98797 Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-98797 Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98797.mbox Red Hat · CVE-2026-98797 · Updated 2026-10-23T15:36:02+00:00