CVE-2026-98850
Received Received - Intake

Integer Overflow in Linux Kernel Packet Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum. Userspace can recycle completed frames concurrently, so a single blocking send call is not bounded by the ring size. After enough successful transmissions len_sum wraps into the negative range. In particular, 65536 65535-byte frames followed by a 65007-byte frame produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats that as an impossible return and triggers a BUG. On systems configured to panic on oops, a CAP_NET_RAW holder can panic the host kernel. Stop before the next frame would make the byte count exceed INT_MAX. The positive short count leaves that frame pending for a later send call. A two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build of Linux 7.3-rc4. With this change, the same reproducer returned the expected positive short count without an oops.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98850
EUVD
EUVD-2026-103790

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1
Linux Linux 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1
Linux Linux 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1
Linux Linux 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1
Linux Linux 2.6.31

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a byte count overflow in the TX_RING feature of the packet socket implementation. When sending packets, the kernel tracks the total length of packets in a signed integer. If enough large packets are sent, this counter can wrap around to a negative value, causing the kernel to treat it as an error and trigger a system crash (BUG).

Detection Guidance

This vulnerability is specific to the Linux kernel's packet handling subsystem and may not have direct detection commands. Monitor kernel logs for oops or panic events related to packet transmission. Check if your kernel version is affected by verifying the presence of the vulnerable code path in net/packet.

Impact Analysis

A user with CAP_NET_RAW privileges could exploit this to crash the system, leading to denial of service. Systems configured to panic on kernel errors will reboot, disrupting services. Non-privileged users cannot directly exploit this.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If immediate patching is not possible, restrict access to CAP_NET_RAW capabilities for untrusted users to prevent exploitation. Monitor system logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart