CVE-2026-98105
Received Received - Intake

Buffer Overflow Recovery Fix in Linux Kernel OA_TC6 Ethernet Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa_tc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with end_valid bit set, before it runs out of sk buffer space. As a result, assert is seen during skb_put. Now, check is made if skb buffer has enough tailroom for the incoming data before accepting. If there is no room, current frame is abandoned and it will start looking for a data chunk with start_valid bit, that is a new frame. SK buffer allocation error is considered as recoverable error. rx_buf_overflow flag is too specific and no longer the only condition this flag is used for. Therefore it is renamed as wait_until_start_valid. This is more appropriate as this flag is used to look for the next data chunk with SV bit set, after failures like buffer overflow, buffer allocation failure, skb pointer validity besides buffer overflow error. Not writing to status0 if it reads 0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98105
EUVD
EUVD-2026-86936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the oa_tc6 Ethernet driver. When network traffic is oversubscribed and causes buffer overflow errors, the driver may fail to find a valid data chunk before running out of sk buffer space. This leads to an assertion failure during skb_put operations. The driver now checks for sufficient tailroom in the sk buffer before accepting data. If no room exists, the current frame is abandoned and a new frame search begins.

Detection Guidance

This vulnerability is specific to the Linux kernel's oa_tc6 ethernet driver and may manifest as buffer overflow errors or skb_put assertions. Detection involves monitoring kernel logs for related errors or driver-specific issues. Check dmesg or journalctl for messages like 'assert during skb_put' or 'buffer overflow errors'.

Impact Analysis

This vulnerability could cause network instability or crashes in systems using the oa_tc6 Ethernet driver. It may lead to data loss during network congestion and require driver restarts or system reboots to recover. Systems handling high network traffic are most affected.

Mitigation Strategies

Update the Linux kernel to the patched version where this vulnerability is resolved. Monitor network traffic for buffer overflow conditions and ensure the oa_tc6 driver is functioning correctly. If issues persist, consider disabling the driver or applying vendor-specific patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart