CVE-2026-98488
Received Received - Intake

Linux kernel Soft Lockup in atl1e Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range hw_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98488
EUVD
EUVD-2026-103728

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux a6a5325239c20202e18e21e94291bccc659fbf9e
Linux Linux 2.6.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's atl1e driver for Atheros Ethernet devices. It causes a soft lockup when the hardware reports an out-of-range value for hw_next_to_clean during a PCIe link or MAC reset. The driver enters an infinite loop because the invalid value can never be reached, causing the system to hang.

Detection Guidance

This vulnerability affects the atl1e network driver in the Linux kernel and may cause soft lockups during PCIe link/MAC resets. Detection involves checking kernel logs for soft lockup messages or driver errors related to atl1e. Monitor system logs with commands like dmesg | grep atl1e or journalctl -k | grep -i lockup. If the driver is in use, examine network interface errors with ethtool -S <interface>.

Impact Analysis

If your system uses the affected Atheros Ethernet device, this vulnerability could cause the system to freeze or become unresponsive during network operations, especially when the PCIe link or MAC is resetting. This may lead to service disruptions or require a system reboot.

Mitigation Strategies

Immediate mitigation includes updating the Linux kernel to a patched version that resolves this issue. Check your distribution's updates or kernel.org for the fixed release. If using a vulnerable kernel version, avoid triggering PCIe link resets or network interface resets until patched. Monitor system stability and network performance for signs of the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart