CVE-2026-98022 Linux CVE debrief

Who should care

Linux kernel administrators and security teams should assess exposure of their deployments to unprivileged users and verify tx_queue_len settings for affected subsystems. Linux kernel administrators and security teams should assess exposure of their deployments to unprivileged users. Verify tx_queue_len settings to prevent oversized ring allocations. Implement compensating controls to limit tx_queue_len values.

Why it matters

An unprivileged user can set a huge tx_queue_len and exhaust global memory with ring allocations, affecting Linux kernel subsystems.

• Verify tx_queue_len settings to prevent oversized ring allocations
• Implement compensating controls to limit tx_queue_len values
• Assess exposure of Linux kernel deployments to unprivileged users

Technical summary

The vulnerability is caused by the lack of an upper bound on tx_queue_len, which can be set by an unprivileged user. This can lead to oversized ring allocations and exhaustion of global memory. The vulnerability affects several subsystems, including pfifo_fast, tun, and tap. netif_change_tx_queue_len() is the single entry point for IFLA_TXQLEN, sysfs, and the SIOCSIFTXQLEN ioctl. Cap new_len at S16_MAX (32767) there so the oversized value is rejected at set time. This takes effect whether the device is up or down, before dev->tx_queue_len is written, before any notifier fires, and before any ring is allocated.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Linux kernel deployments to unprivileged users
• Verify tx_queue_len settings for affected subsystems
• Implement compensating controls to limit tx_queue_len values
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of an upper bound on tx_queue_len, which can be set by an unprivileged user. This can lead to oversized ring allocations and exhaustion of global memory. The vulnerability affects several subsystems, including pfifo_fast, tun, and tap. Conditions to recreate the bug: CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y. Unprivileged user in a fresh user+net namespace (unshare -Urn). pfifo_fast: create veth pairs, set tx_queue_len to 500000, attach mq+pfifo_fast. ~28 iterations O0

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.