CVE-2026-98797Medium· 5.5▾ SunlitA flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network inter…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 5.5
none → medium
A flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network interfaces with differing numbers of transmit queues, the kernel fails to properly cap queue mappings during egress traffic scheduling. This flaw allows an attacker to cause the kernel to read out-of-bounds memory, resulting in a system crash.
kernel: net: cap skb->queue_mapping when the tx queue is picked — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72107Medium· 5.5kernel: dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107)
CVE-2026-64551High· 7.0kernel: sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
CVE-2026-64546Medium· 5.5kernel: drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
CVE-2026-64540Medium· 5.5kernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)
CVE-2026-64524Medium· 5.5kernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
CVE-2026-64448High· 7.0kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)