CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98797

The Linux kernel is vulnerable to a slab-out-of-bounds error in taprio_enqueue() caused by a stale skb->queue_mapping value. When using skbedit, a nested transmit (such as a mirror or redirect) could set the skip_txqueue flag, which the outer transmit might incorrectly consume. If a forwarded ...