CVE-2026-98317

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied: # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is silently cast to u32, so a larger value can bypass the min check: e.g. 4294967296 == 0x100000000 # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 msecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is larger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR() when HZ > 1000 (Alpha, MIPS), and passing a negative integer to queue_delayed_work(unsigned long delay) causes sign extension, which wraps around the expiry time to the past, resulting in it being handled as 0 delay in the timer wheel. Let's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day. The same max check is applied to sysctl as well. Note that this controls the probe interval for NTF_MANAGED entries, so the max of 1 day is unlikely to break any deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98317

EUVD

EUVD-2026-93302

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	211da42eaa45db7b0edfde187dd88a85fbd466b5
Linux	Linux	211da42eaa45db7b0edfde187dd88a85fbd466b5
Linux	Linux	211da42eaa45db7b0edfde187dd88a85fbd466b5
Linux	Linux	6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of the NDTPA_INTERVAL_PROBE_TIME_MS parameter in the neighbour subsystem. The issue occurs because the parameter's validation type is missing, allowing invalid values like 0 or excessively large numbers (e.g., 4294967296) to bypass checks. This can lead to incorrect timer handling, causing delayed work queues to expire immediately or wrap around, potentially disrupting network neighbour table operations.

Detection Guidance

This vulnerability can be detected by checking the ARP cache parameters for invalid interval-probe-time-ms values. Use commands like 'ynl --family rt-neigh --dump getneightbl --output-json' to inspect the ARP cache configuration. Look for values set to 0 or excessively large numbers like 4294967296.

Impact Analysis

This vulnerability could cause network instability by disrupting neighbour table probe intervals. Attackers might exploit it to trigger immediate or past-due timer expirations, leading to unexpected behaviour in network communication or denial-of-service conditions. Systems relying on ARP or NDISC for neighbour discovery could experience connectivity issues or crashes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a kernel parameter validation issue in the Linux network stack that could allow incorrect probe interval values. No evidence suggests this impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the Linux kernel patch that enforces min/max validation for NDTPA_INTERVAL_PROBE_TIME_MS. Ensure the interval-probe-time-ms value is set within valid limits (e.g., not 0 or excessively large). Update to a kernel version that includes the fix.

Hi! I’m here to help you understand CVE-2026-98317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70