CVE-2026-98021

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink (rtnetlink) interface, the kernel fails to validate and enforce maximum limits on the transmission queue length (tx_queue_len) attribute. An attacker, including an unprivileged user inside a user namespace, can exploit this issue by requesting an excessively large queue length value, leading to oversized buffer allocations that exhaust system memory.

A low impact denial of service flaw was found in the Linux kernel's rtnetlink handling of network device creation and modification. When a network interface is created or updated through rtnetlink, the kernel does not validate the IFLA_TXQLEN (tx_queue_len) attribute against its maximum allowed value, so a device can be created or changed with an excessively large transmission queue length. A local user, including an unprivileged user able to create user and network namespaces, can exploit this by requesting an oversized queue length, which later inflates ring and buffer allocations in pfifo_fast, tun and tap, exhausting host memory and causing a denial of service. There is no impact on confidentiality or integrity.

This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux, the kernels in Red Hat In-Vehicle OS, and the RHEL CoreOS images shipped with OpenShift Container Platform. For these affected products the fix is currently deferred, so the residual risk of local denial of service through memory exhaustion remains until a fix is released. The Red Hat Enterprise Linux 6 kernel is out of support scope for this issue.

Red Hat rates the impact of this flaw as Low: although the CVSS:3.1 base score of 5.5 reflects a high availability impact, exploitation requires local access, and actual memory exhaustion depends on the host's memory limits and configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.