« Volver al listado

CVE-2026-98233

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error

Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed.

With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet.

Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98233",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "bb10a0084c03a94364aeec542beddc5d49b59f59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "b8c0cb3069058c2d67b5c7c833b2833381ecffdc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "2daa618e7ff19eefcbda281bc4c5998c4140f9cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "23cd30498891d29a69ec9b75bd92f8a0f21f1342",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "49a48a5aaf85fe69d2dc3fb334b4854fadf44e39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "805edbdcb8681da5f7ee43b3c3c809f7a8c31208",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "693209a237fc548791cf402441db8b68d1da7d38",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
              "lessThan": "33ff111d7ba3beb86e28938d6382bb5beabd865a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2975472e042e0bbfeeabddc5023cb8c011ec5a07",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fb0e4385928900ccb8697748555b3f54bba5193",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "86137342fd4cf52882842aa8d1318b2661f08e8a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b06e4d3ed4044c2facf10a511d809f9aa29d960e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.14.175",
              "lessThan": "4.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.19.114",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.29",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.5.14",
              "lessThan": "5.6",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:10.857",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header.  If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path.  TPACKET_V3 already clears\nits block state here."
    }
  ],
  "lastModified": "2026-10-06T09:18:10.857",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}