CVE-2026-98489
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.18 %mayor que el 7 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
net: atl1c: corrige un bloqueo blando (soft lockup) por una lectura fuera de rango de tpd_cons
El hardware puede notificar un valor fuera de rango en tpd_cons (observado como 0xffff) mientras el enlace PCIe o la MAC se están reiniciando. Un valor fuera de rango nunca puede alcanzarse y el bucle siguiente giraría indefinidamente. Para evitar un soft lockup, ese valor se trata como "nada nuevo que limpiar".
Reproducido en dos equipos, con la misma tarjeta de red (Qualcomm Atheros AR8151 v2.0, 4 puertos), al reiniciar una tarjeta PCIe Mikrotik CCR2004 a la que los puertos están conectados directamente:
Leer descripción completaMostrar menos
- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. Precursor de la caída de enlace, antes de que se capturara el bloqueo con una traza completa en otro lugar:
- Proxmox VE, kernel 7.0.14-11-pve. Misma NIC y mismo desencadenante, esta vez detectado por el watchdog de soft lockup con una traza de pila completa:
Detalles técnicos trazas, registros y código del informe original
atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms
atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second
atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>
65535 (0xffff) es aquí el mismo valor que tpd_cons devuelve una vez que el bucle siguiente se queda bloqueado.
watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]
CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)
RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]
Call Trace:
<TASK>
__napi_poll+0x32/0x1e0
napi_threaded_poll_loop+0x286/0x2e0
napi_threaded_poll+0xfd/0x140
kthread+0xf7/0x130
ret_from_fork+0x2da/0x3a0
ret_from_fork_asm+0x1a/0x30
</TASK>Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.18 %
- Percentil entre todas las CVEs puntuadas
- 7
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754
- https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586
- https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc
- https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841
- https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13
- https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43
- https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16
- https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98489",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "5ea2576a4f5ec476f33169fdbe9090d2b038ad13",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "4daf80da0c38b8cd92c111ad96cb38322aabf586",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "57b55367b6e3accc55a989afeaf127063e3614dc",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "9f2cc71a2e2799d9c993c73f1bd36507eef6ae43",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "586847400b1168a88917287ac02c2c91a620b841",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "d4ab263e40fcf7cfa38a43ec774067d32eb94e16",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "36c2009d90f2210ef92e6f4f2850e8b57b09e754",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atl1c/atl1c_main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.29",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atl1c/atl1c_main.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:59.733",
"references": [
{
"url": "https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n precursor, before the lockup was captured with a full trace\n elsewhere:\n\n atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n 65535 (0xffff) here is the same value tpd_cons reads back once the\n loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n caught by the soft lockup watchdog with a full stack trace:\n\n watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n Call Trace:\n <TASK>\n __napi_poll+0x32/0x1e0\n napi_threaded_poll_loop+0x286/0x2e0\n napi_threaded_poll+0xfd/0x140\n kthread+0xf7/0x130\n ret_from_fork+0x2da/0x3a0\n ret_from_fork_asm+0x1a/0x30\n </TASK>"
}
],
"lastModified": "2026-10-19T10:19:00.667",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}