{"id":"CVE-2026-98797","title":"kernel: net: cap skb->queue_mapping when the tx queue is picked (CVE-2026-98797)","summary":"A flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network inter…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T15:36:02+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98797.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98797.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98797"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555185"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98797"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98797"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98797.mbox"},{"url":"https://git.kernel.org/stable/c/c6ec35c8267c84c2094cb485db20c06384fc2bcc"},{"url":"https://git.kernel.org/stable/c/2f581814e4e3ea6a5e98f49813dc4c68444a0c4a"},{"url":"https://git.kernel.org/stable/c/f99de42f5c6f8d088063817dad82c3334e87c570"},{"url":"https://git.kernel.org/stable/c/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.0016,"epssPercentile":0.05163,"ingestedAt":"2026-10-18T16:47:32.483Z","slug":"CVE-2026-98797","body":"## Overview\n\nA flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network interfaces with differing numbers of transmit queues, the kernel fails to properly cap queue mappings during egress traffic scheduling. This flaw allows an attacker to cause the kernel to read out-of-bounds memory, resulting in a system crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98797.json)\n\n**kernel: net: cap skb->queue_mapping when the tx queue is picked** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 7\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228714,"id":"CVE-2026-98797","ts":1792844933867,"field":"cvss","old":null,"new":"5.5"},{"seq":228713,"id":"CVE-2026-98797","ts":1792844933867,"field":"severity","old":"none","new":"medium"}]}