CVE-2026-98021
Description
A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink (rtnetlink) interface, the kernel fails to validate and enforce maximum limits on the transmission queue length (tx_queue_len) attribute. An attacker, including an unprivileged user inside a user namespace, can exploit this issue by requesting an excessively large queue length value, leading to oversized buffer allocations that exhaust system memory.
Statement
A low impact denial of service flaw was found in the Linux kernel's rtnetlink handling of network device creation and modification. When a network interface is created or updated through rtnetlink, the kernel does not validate the IFLA_TXQLEN (tx_queue_len) attribute against its maximum allowed value, so a device can be created or changed with an excessively large transmission queue length. A local user, including an unprivileged user able to create user and network namespaces, can exploit this by requesting an oversized queue length, which later inflates ring and buffer allocations in pfifo_fast, tun and tap, exhausting host memory and causing a denial of service. There is no impact on confidentiality or integrity.
This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux, the kernels in Red Hat In-Vehicle OS, and the RHEL CoreOS images shipped with OpenShift Container Platform. For these affected products the fix is currently deferred, so the residual risk of local denial of service through memory exhaustion remains until a fix is released. The Red Hat Enterprise Linux 6 kernel is out of support scope for this issue.
Red Hat rates the impact of this flaw as Low: although the CVSS:3.1 base score of 5.5 reflects a high availability impact, exploitation requires local access, and actual memory exhaustion depends on the host's memory limits and configuration.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
