In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below… (CVE-2026-98567)

The Linux kernel vulnerability (CVE-2026-98567) involves improper handling of traffic classes in the net: xps component. Specifically, only traffic classes below dev->num_tc are valid in dev->tc_to_txq[] and dev->prio_tc_map[]. When netdev_set_num_tc() lowers dev->num_tc, it does not clear these arrays, leaving stale entries that reference invalid traffic classes. Functions like netdev_txq_to_tc() and netdev_get_prio_tc_map() can return these invalid classes, which are then used to index into attr_map[], an array sized by nr_ids * num_tc. This leads to an out-of-bounds write in __netif_set_xps_queue(), causing a kernel slab-out-of-bounds error detected by KASAN. The vulnerability is triggered when num_tc is reduced without resetting the traffic class mappings, such as when mqprio_destroy() calls netdev_set_num_tc(dev, 0) instead of netdev_reset_tc(). The fix involves rejecting traffic classes that exceed the map's size to prevent overruns.

The vulnerability causes a kernel memory corruption due to an out-of-bounds write, which can lead to system instability or crashes (kernel BUG). While no active exploits are known, the issue could potentially be leveraged to cause denial of service or other kernel-level impacts.

A fix is available that rejects traffic classes that exceed the allocated map size, preventing out-of-bounds writes. Users should apply the official Linux kernel patch that addresses this issue. Until patched, avoid configurations that reduce num_tc without properly resetting traffic class mappings.