CVE-2026-98022
Description
A flaw was found in the Linux kernel. Multiple network subsystems allocate memory buffers based on the transmit queue length without enforcing an upper bound. A local unprivileged user can exploit this vulnerability by configuring an excessively large queue length on network devices, exhausting system memory and causing a Denial of Service (DoS).
Statement
A moderate-impact denial-of-service vulnerability exists in the Linux kernel as shipped in Red Hat Enterprise Linux. Several networking subsystems (pfifo_fast, tun, and tap/macvtap/ipvtap) size ring buffer allocations from the per-device transmit queue length (dev->tx_queue_len) without enforcing an upper bound. A local unprivileged attacker who can create user and network namespaces (for example via unshare -Urn) can set an arbitrarily large transmit queue length through netlink, sysfs, or the SIOCSIFTXQLEN ioctl and repeatedly create or reconfigure network devices, exhausting global kernel memory and causing an out-of-memory denial of service. Confidentiality and integrity are not affected; the Red Hat severity is MODERATE with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 8, 9, and 10 (including kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS layers of OpenShift Container Platform 4 and 5 are recorded as affected, with the fix deferred to a future scheduled kernel update; until such an update ships, the residual risk is that any host allowing unprivileged local users to create user and network namespaces can be memory-exhausted and rendered unavailable. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream, and Red Hat Enterprise Linux 6 is out of support scope for this issue.
Mitigation
The unprivileged attack path documented upstream depends on an unprivileged local user creating a user and network namespace (unshare -Urn) to gain the ability to configure network devices. As a workaround, unprivileged creation of user namespaces can be restricted, for example by setting the sysctl user.max_user_namespaces=0, which prevents unprivileged local users from triggering this issue. Note that this can disrupt software that relies on unprivileged user namespaces, including some container configurations, and it does not prevent misuse by users who already hold network administration privileges (CAP_NET_ADMIN) on the host.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
