SB20260928181 - Improper Validation of Specified Quantity in Input in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-98021)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause excessive memory allocation.

The vulnerability exists due to improper validation of a specified quantity in input in the IFLA_TXQLEN netlink attribute when processing netlink requests that specify a transmit queue length. A local user can submit a netlink request with an oversized tx_queue_len value to cause excessive memory allocation.

Exploitation requires network scheduling, veth, user namespace, and network namespace support.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1aa9e143bf51405665a793d4cc925e1c4f0c5922
• https://git.kernel.org/stable/c/2fd0880f0272ec022906a05587fd91416ebecc38
• https://git.kernel.org/stable/c/45ca9f59b6c7ea70e0a17054902b8a556913db34
• https://git.kernel.org/stable/c/a638a2625aa83160a394abe8e8b2e524a80c771b