BLOG
At a glance
- CVE-2026-98797 affects Linux Kernel Net Scheduler Qdisc.
- A local user with low privileges may escalate privileges and execute code in the kernel context.
- Linux has released a fix; the specific version is not provided in the record.
- Check the running kernel and prioritize applying the fix.
Linux Kernel: CVE-2026-98797 allows local users to escalate privileges
Zero Day Initiative reports CVE-2026-98797 in Linux Kernel Net Scheduler Qdisc. Improper input validation can cause an out-of-bounds write, potentially enabling privilege escalation and code execution in the kernel context. Check the running kernel and prioritize the Linux fix.
In this article
Zero Day Initiative published an advisory for CVE-2026-98797 in Linux Kernel Net Scheduler Qdisc. The flaw may allow a local user to escalate privileges; Linux has released a fix, but the record does not specify a version. Read the Zero Day Initiative advisory.
Overview and technical details
The flaw is in the taprio_enqueue function, where input data is not correctly validated. This may cause an out-of-bounds write past the end of an allocated array.
| Field | Details |
|---|---|
| Product | Linux Kernel Net Scheduler Qdisc |
| CVE | CVE-2026-98797 |
| CVSS | 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) |
| Source | Zero Day Initiative |
Affected systems
The record identifies Linux Kernel as affected but does not specify a branch or version. An attacker needs the ability to run code with low privileges on the system.
Mechanism and impact
The out-of-bounds write may lead to privilege escalation and arbitrary code execution in the kernel context. These are potential impacts of successful exploitation according to the technical record.
System checks
Check the kernel version currently running:
uname -rCompare the result with the operating system vendor’s kernel update information. The record does not specify a fixed version.
Remediation and mitigation
Prioritize updating Linux Kernel with the fix released by Linux, especially on systems that allow unprivileged users to run local code.
The fix is referenced in the Linux commit.
References
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel: n_gsm race condition may enable local privilege escalation
Zero Day Initiative published an advisory for CVE-2024-50073, a race condition in the Linux Kernel n_gsm driver. An attacker needs local access to execute highly privileged code; successful exploitation may enable privilege escalation and code execution in the kernel context. Identify the kernel…
Linux Kernel: SCTP race condition allows privilege escalation
Zero Day Initiative disclosed CVE-2026-98130, a race condition in the Linux Kernel SCTP subsystem. A local low-privileged user may escalate privileges and execute code in kernel context. Prioritize installing the Linux fix; the record does not specify affected or fixed versions.
Linux Kernel ksmbd out-of-bounds read could expose sensitive information
Zero Day Initiative disclosed CVE-2026-64138 in Linux Kernel ksmbd: an out-of-bounds read could expose sensitive information. Only systems with ksmbd enabled are affected; prioritize updating the kernel through the Linux vendor.