{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: xps: reject an out of range traffic class  Only the entries below dev-\u003enum_tc are valid in dev-\u003etc_to_txq[], and dev-\u003eprio_tc_map[] may only name classes below it. netdev_set_num_tc() lowers dev-\u003enum_tc without touching either array.  netdev_txq_to_tc() walks all TC_MAX_QUEUE slots and netdev_get_prio_tc_map() returns the entry as it stands, so a leftover entry is handed out as a traffic class \u003e= dev-\u003enum_tc. Taking that class from netdev_txq_to_tc(), __netif_set_xps_queue() rejects only a negative one and indexes an XPS map sized for dev-\u003enum_tc classes:  \ttci = j * num_tc + tc; \tRCU_INIT_POINTER(new_dev_maps-\u003eattr_map[tci], map);  attr_map[] holds nr_ids * num_tc entries and j runs over the ids named in the mask, so a class that is not below num_tc pushes tci past the end of the map for the last ids and the store overruns it.  Any caller that lowers num_tc leaves such entries behind, and mqprio_destroy() tears down with netdev_set_num_tc(dev, 0) rather than netdev_reset_tc(). After mqprio with 8 classes then 1, tc_to_txq[1..7] still describe txq 1..7. The splat is from an XPS write to txq 2 on a veth with 8 rx queues: attr_map[] has 8 * 1 entries, tci = j + 2, and j == 6 stores one past the end of the 88-byte map:    BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue (net/core/dev.c:2954)   Write of size 8 at addr ffff88813016bc58 by task xps_oob/634    __netif_set_xps_queue (net/core/dev.c:2954)    xps_rxqs_store (net/core/net-sysfs.c:1880)    netdev_queue_attr_store (net/core/net-sysfs.c:1390)   Allocated by task 634:    __kmalloc_noprof (mm/slub.c:5439)    __netif_set_xps_queue (net/core/dev.c:2937)   The buggy address is located 0 bytes to the right of    allocated 88-byte region [ffff88813016bc00, ffff88813016bc58)  Reject a class the map has no room for.",
  "id": "DEBIAN-CVE-2026-98567",
  "modified": "2026-10-19T04:47:28.110469389Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98567"
    }
  ],
  "upstream": [
    "CVE-2026-98567"
  ]
}