CVE-2026-98567: net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved:

net: xps: reject an out of range traffic class

Only the entries below dev->numtc are valid in dev->tctotxq[], and dev->priotcmap[] may only name classes below it. netdevsetnumtc() lowers dev->numtc without touching either array.

netdevtxqtotc() walks all TCMAXQUEUE slots and netdevgetpriotcmap() returns the entry as it stands, so a leftover entry is handed out as a traffic class >= dev->numtc. Taking that class from netdevtxqtotc(), netifsetxpsqueue() rejects only a negative one and indexes an XPS map sized for dev->numtc classes:

tci = j numtc + tc; RCUINITPOINTER(newdevmaps->attrmap[tci], map);

attrmap[] holds nrids numtc entries and j runs over the ids named in the mask, so a class that is not below numtc pushes tci past the end of the map for the last ids and the store overruns it.

Any caller that lowers numtc leaves such entries behind, and mqpriodestroy() tears down with netdevsetnumtc(dev, 0) rather than netdevresettc(). After mqprio with 8 classes then 1, tctotxq[1..7] still describe txq 1..7. The splat is from an XPS write to txq 2 on a veth with 8 rx queues: attrmap[] has 8 1 entries, tci = j + 2, and j == 6 stores one past the end of the 88-byte map:

BUG: KASAN: slab-out-of-bounds in netifsetxpsqueue (net/core/dev.c:2954) Write of size 8 at addr ffff88813016bc58 by task xpsoob/634 netifsetxpsqueue (net/core/dev.c:2954) xpsrxqsstore (net/core/net-sysfs.c:1880) netdevqueueattrstore (net/core/net-sysfs.c:1390) Allocated by task 634: kmallocnoprof (mm/slub.c:5439) netifsetxpsqueue (net/core/dev.c:2937) The buggy address is located 0 bytes to the right of allocated 88-byte region [ffff88813016bc00, ffff88813016bc58)

Reject a class the map has no room for.