{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "38f7b870d4a6a5d3ec21557e849620cb7d032965"
            },
            {
              "fixed": "45ca9f59b6c7ea70e0a17054902b8a556913db34"
            },
            {
              "fixed": "2fd0880f0272ec022906a05587fd91416ebecc38"
            },
            {
              "fixed": "a638a2625aa83160a394abe8e8b2e524a80c771b"
            },
            {
              "fixed": "1aa9e143bf51405665a793d4cc925e1c4f0c5922"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.23"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98021.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: reject oversized tx_queue_len at netlink parse time\n\nrtnl_create_link() assigns IFLA_TXQLEN directly to dev-\u003etx_queue_len\nwithout going through netif_change_tx_queue_len(), so a device created\nwith \"ip link add ... txqueuelen 500000\" bypasses the S16_MAX cap and\nstill triggers the oversized ring allocations in pfifo_fast, tun and\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the\nRTM_NEWLINK-on-existing-device path reach the same sinks.\n\nEnforce the cap in ifla_policy instead: IFLA_TXQLEN becomes\nNLA_POLICY_FULL_RANGE(NLA_U32, \u0026txqlen_range) with\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers\nparse against this policy - rtnl_setlink(), rtnl_newlink() (create\nand change), and the veth peer nest - so every netlink path is capped\nat parse time and rejects the attribute with -ERANGE plus a proper\n\"integer out of range\" extack message before any device state is\nmodified (the RTM_SETLINK half-application wart is gone with it).\n\nDocument the bound in the rt-link.yaml netlink spec.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.\n- Unprivileged user in a fresh user+net namespace (unshare -Urn):\n  ip link add v0 txqueuelen 500000 type veth peer name v1\n  -\u003e on the fixed kernel this is rejected with -ERANGE (\"integer out\n  of range\" extack) instead of installing an oversized tx_queue_len\n  that later inflates pfifo_fast/tun/tap ring allocations.\n- ip link set v0 txqueuelen 500000 is likewise rejected at parse time.",
  "id": "CVE-2026-98021",
  "modified": "2026-09-26T03:30:46.030754129Z",
  "published": "2026-09-25T10:23:41.505Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98021.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98021"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "net: reject oversized tx_queue_len at netlink parse time"
}