[CVE-2026-98567][IMPORTANT] net: xps: reject an out of range traffic class [ Upstream

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-98567
Priority: IMPORTANT
AL-KERNEL base severity: IMPORTANT
KPANIC flag: NO
Patch: net: xps: reject an out of range traffic class [ Upstream
Commit: 967e10f40a0c6732db299cbe001df0e859196055
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=967e10f40a0c6732db299cbe001df0e859196055
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98567
Analysis date: Fri, 23 Oct 2026 21:40:35 -0400
ActionableScore: 6
ActionableScore lower bound: 5
Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review
Manual review required: YES

Summary:
A stale traffic class can make an XPS sysfs update perform a pointer sized slab out of bounds write beyond attr_map, creating a local kernel heap corruption primitive whose privilege boundary and exploitation leverage require manual review.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98567 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98567

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: IMPORTANT
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98567	IMPORTANT	https://www.kernelcve.org/list/?q=CVE-2026-98567 CHECK WITH IMPACT FROM ORIG NN IMPORTANT | AEGIS IMPACT MODERATE_KPANIC AEGIS_AS=1 LEGACY=IMPORTANT RESULT=DIFF INDEPENDENT_LEGACY=IMPORTANT INDEPENDENT_RESULT=DIFF TEMP_KPANIC_MERGE=IMPORTANT_HARD_VETO PRE_MERGE_LEGACY=IMPORTANT (final Legacy and Aegis differ; FINAL: IMPORTANT, Aegis: MODERATE_KPANIC)	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-787;CWE-129;*CWE-20;Other CVSS 'AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H';BEST CVSS score: '7';DESCR 'A stale traffic class can survive after netdev_set_num_tc reduces dev num_tc because the related traffic class arrays are not reset. A later XPS sysfs update can obtain this stale class through netdev_txq_to_tc and use it when indexing an attr_map allocated for the smaller number of classes. This produces a slab out of bounds write of a kernel pointer, with KASAN demonstrating an 8 byte write immediately beyond an 88 byte allocation. The trigger requires local control plane operations that configure mqprio, reduce the number of traffic classes, and update an XPS queue. It is not reachable through ordinary network packets. For the CVSS the PR:L in the highest score paranoid vector reflects a local user who can create user and network namespaces and obtain CAP_NET_ADMIN for a namespaced veth when that functionality is enabled. Typical host wide configuration requires administrative CAP_NET_ADMIN and is represented by PR:H in the conservative vector. The established primitive is a bounded slab out of bounds pointer write rather than a proven arbitrary write. Impact is at least local denial of service and may include confidentiality or integrity compromise if a useful adjacent slab object can be corrupted. Reliable privilege escalation remains unproven and requires manual review of allocation control, write offsets, pointer value constraints, and reachable victim objects. Automated impact decision path. The original SimpleNet classifier selected IMPORTANT. The primary LLM estimated paranoid CVSS 7 and the production ActionableScore returned 6 with recommendation Actionable Moderate / Strong Important candidate requiring manual review. The production rules then evaluated CVSS thresholds and ActionableScore thresholds. Recorded rule transitions were final reconciliation stage IMPORTANT to IMPORTANT because a specific evidence based protection or manual review veto was applied and KP specialist did not establish a qualifying panic. The legacy KP specialist has no review artifact for this run. The legacy FD or DH downgrade specialist produced a review artifact and its decision was processed by the applicable downgrade and preservation rules. Exact triggered rule markers were TEMP_KPANIC_MERGE_IMPORTANT_VETO and KPANIC_UNSUPPORTED_REMOVED. The independent weaker Aegis shadow evaluated CVSS 2.3 and ActionableScore 1 with primitive class CLASS_B and manual review REQUIRED. Its independently reconciled impact was MODERATE_KPANIC. Cross model aggregation changed the production result under an enabled evidence gated merge rule. The final reported impact is IMPORTANT.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 6)	MAYBE	REMOTE WRITE KASAN OOB LINUS TEMP_KPANIC_MERGE_IMPORTANT_VETO KPANIC_UNSUPPORTED_REMOVED	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=6
ActionableScoreLower=5
PrimitiveClass=CLASS_B
RealUAF=NO
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
RequiresHostUID0=UNKNOWN
AuthorizationDecisionBypass=NO
ProtectedResourceImpact=NONE
B4PendingReview=NO
B4PendingConfirmed=NO

1. ActionableScore

* Raw conservative score: 5
* Conservative score: 5
* Raw paranoid score: 6
* Paranoid score: 6
* Conservative CVSS:3.1 vector: AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H (5.5)
* Highest defensible paranoid CVSS:3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0)
* No floor or cap changed either ActionableScore.
* Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**::

2. Signal breakdown

* +2 Confirmed strong kernel corruption. KASAN directly demonstrates an 8 byte slab out of bounds write immediately after an 88 byte XPS map allocation.
* +1 Attacker influenced relative write offset. The selected TX queue, stale traffic class, RX queue mask, and identifier index affect the out of bounds attr_map index.
* +1 Nontrivial write value. The stored value is a kernel map pointer rather than a fixed zero or harmless scalar, although its numeric value is not freely chosen.
* +1 Availability impact. Corruption immediately beyond a live heap object can cause a kernel fault or destabilize later processing. The supplied evidence demonstrates the corruption but not a non KASAN panic.
* +1 Paranoid exploitation leverage. A pointer sized overwrite beyond a slab allocation can affect an adjacent object, but the victim object and later consumption are unresolved. This point is used only in the paranoid score.
* Controlled reclaim is not demonstrated.
* An arbitrary address or arbitrary payload write is not demonstrated.
* A named adjacent victim object is not demonstrated.
* Information disclosure, protected state modification, and privilege escalation are not demonstrated.
* Remote packet reachability is not established. Ordinary packets do not invoke this XPS sysfs control path.
* No race penalty applies. The vulnerable sequence is an ordered configuration sequence rather than a timing race.
* No host administrator penalty is applied to the ActionableScore because the complete privilege boundary is unresolved.
* B5-R is not established. The index does not accumulate across retries, and later consumption of a specifically corrupted adjacent object is not shown.
* V33 active structured state consumption is unresolved. The actual out of bounds write is established, but the type and use of the adjacent overwritten state are not.
* B3-PENDING does not apply because this is not a shared backing or file backed write.
* B4-PENDING does not apply because no authorization DENY to ALLOW transition exists.

3. Reachability analysis

The demonstrated call path is netdev_queue_attr_store to xps_rxqs_store to __netif_set_xps_queue. The trigger first creates a stale traffic class by configuring mqprio with multiple classes and then reducing dev num_tc without resetting tc_to_txq or prio_tc_map. A later XPS write for a queue associated with the stale class reaches the out of bounds attr_map store.

The operation is local and control plane driven. It is not triggered by received network traffic. Configuring mqprio and controlling a network device require CAP_NET_ADMIN in the applicable network user namespace. The XPS update is exposed through a net sysfs queue attribute, but the supplied evidence does not fully establish whether an ordinary user who creates user and network namespaces can also satisfy every sysfs ownership, mount, capability, and qdisc requirement. Therefore HostAdminRequired and NamespaceScopedPrivilege remain UNKNOWN.

The conservative CVSS uses PR:H because the directly demonstrated configuration workflow is administrative. The paranoid CVSS uses PR:L because a delegated network management process or a namespace capable actor may hold the required limited network administration privilege without possessing full host administrator powers. PR:N is not defensible because local configuration operations and an XPS device interface are required.

No special hardware is required by the supplied reproducer because the failure is demonstrated on a veth device with multiple queues. No timing race or retry accumulation is required. Whether a fully unprivileged user can instantiate and complete the entire sequence depends on namespace and sysfs policy that is not resolved by the patch.

4. Primitive and severity interpretation

The exact primitive is a slab out of bounds write of one or more kernel pointer values beyond new_dev_maps attr_map. The stale traffic class can be larger than the current num_tc, making tci exceed the allocated nr_ids multiplied by num_tc range. The supplied KASAN report demonstrates an 8 byte write at the first byte after the allocation.

This is active heap corruption rather than an invalid read, NULL dereference, resource leak, race, UAF, or authorization bypass. It is not a repeated release or refcount mutation. RealUAF is NO.

PrimitiveClass is CLASS_B because a real and potentially exploitable kernel heap overwrite exists, but no arbitrary target, freely selected payload, controlled reclaim, callback overwrite, protected state modification, or completed privilege escalation chain is established. The primitive is stronger than crash only Class C behavior, but the evidence is insufficient for CLASS_A.

The demonstrated consequence is kernel heap corruption detected by KASAN. A production kernel crash is credible but not directly demonstrated. Confidentiality or integrity compromise requires the out of bounds store to reach a useful adjacent object that is later consumed. That secondary object, allocator placement, and consumer are unresolved.

ImportantCandidate is YES because a configurable pointer sized kernel heap overwrite has meaningful unresolved exploitation leverage beyond an ordinary invalid dereference. AutoDowngradeAllowed is NO because automatic downgrade would discard a concrete write primitive before allocator placement, offset range, repeated writes, and adjacent victim objects are reviewed. This does not prove Important severity or local privilege escalation.

CWE identifiers are CWE-787, CWE-129, and CWE-20.

5. One-sentence report phrase

A stale traffic class can make an XPS sysfs update perform a pointer sized slab out of bounds write beyond attr_map, creating a local kernel heap corruption primitive whose privilege boundary and exploitation leverage require manual review.

6. Manual review recommendation

MANUAL CHECK REQUIRED

Review the complete privilege checks for mqprio and XPS sysfs writes, namespace reachability, the full writable offset range, allocation cache and adjacency, repeated overwrite behavior, stored pointer constraints, and whether a corrupted neighboring object is consumed after the write.

7. Call-site confidence

Call-site confidence: high

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: net: xps: reject an out of range traffic class [ Upstream
Commit: 967e10f40a0c6732db299cbe001df0e859196055
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=967e10f40a0c6732db299cbe001df0e859196055

Changed files:
  net/core/dev.c
  net/core/net-sysfs.c
  mm/slub.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=967e10f40a0c6732db299cbe001df0e859196055

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98567 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98567

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: 5
  Paranoid ActionableScore: 6

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: IMPORTANT
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): IMPORTANT

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).