CVE-2026-98489
Received Received - Intake

Soft lockup in Linux kernel atl1c driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead. Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to: - Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap precursor, before the lockup was captured with a full trace elsewhere: atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex> 65535 (0xffff) here is the same value tpd_cons reads back once the loop below gets stuck. - Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time caught by the soft lockup watchdog with a full stack trace: watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329] CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy) RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c] Call Trace: <TASK> __napi_poll+0x32/0x1e0 napi_threaded_poll_loop+0x286/0x2e0 napi_threaded_poll+0xfd/0x140 kthread+0xf7/0x130 ret_from_fork+0x2da/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98489
EUVD
EUVD-2026-103729

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 43250ddd75a35d1f7926d989a10fefd30c37eaa7
Linux Linux 2.6.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a soft lockup issue in the atl1c network driver. When the hardware reports an out-of-range tpd_cons value (0xffff) during PCIe link or MAC reset, the driver's cleanup loop spins indefinitely because the value can never be reached. The fix treats such out-of-range values as 'nothing new to clean' to prevent the lockup.

Detection Guidance

This vulnerability manifests as a soft lockup in the atl1c driver when the NIC reports an out-of-range tpd_cons value during PCIe link/MAC reset. Monitor kernel logs for soft lockup warnings or watchdog timeouts related to the atl1c driver or network interface. Check for messages like 'transmit queue timed out' or 'MAC state machine can't be idle' in dmesg or journalctl output.

Impact Analysis

This vulnerability can cause system freezes or unresponsiveness due to soft lockups, particularly when network hardware resets occur. It may lead to network timeouts, degraded performance, or system crashes during critical operations like reboots or link flaps.

Compliance Impact

This vulnerability causes a soft lockup in the Linux kernel's network driver (atl1c) due to an out-of-range tpd_cons read during PCIe link/MAC resets. It can lead to network timeouts, system unresponsiveness, and potential data transmission failures, which may impact availability and integrity of systems handling sensitive data.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If an update is not immediately available, consider temporarily disabling the affected NIC or using an alternative network interface until the patch is applied. Monitor vendor advisories for driver updates specific to the Qualcomm Atheros AR8151 NIC.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart