CVE-2026-98489
Status: ReceivedUnscored—
Severity—Unscored
Exploitation probability0.18 %higher than 7% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
In the Linux kernel, the following vulnerability has been resolved:
net: atl1c: fix soft lockup on out-of-range tpd_cons read
The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead.
Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to:
Technical details traces, logs and code from the original report
- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap
precursor, before the lockup was captured with a full trace
elsewhere:
atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms
atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second
atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>
65535 (0xffff) here is the same value tpd_cons reads back once the
loop below gets stuck.
- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time
caught by the soft lockup watchdog with a full stack trace:
watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]
CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)
RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]
Call Trace:
<TASK>
__napi_poll+0x32/0x1e0
napi_threaded_poll_loop+0x286/0x2e0
napi_threaded_poll+0xfd/0x140
kthread+0xf7/0x130
ret_from_fork+0x2da/0x3a0
ret_from_fork_asm+0x1a/0x30
</TASK>CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.18 %
- Percentile among all scored CVEs
- 7
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 8 references
- https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754
- https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586
- https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc
- https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841
- https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13
- https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43
- https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16
- https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98489",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "5ea2576a4f5ec476f33169fdbe9090d2b038ad13",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "4daf80da0c38b8cd92c111ad96cb38322aabf586",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "57b55367b6e3accc55a989afeaf127063e3614dc",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "9f2cc71a2e2799d9c993c73f1bd36507eef6ae43",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "586847400b1168a88917287ac02c2c91a620b841",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "d4ab263e40fcf7cfa38a43ec774067d32eb94e16",
"versionType": "git"
},
{
"status": "affected",
"version": "43250ddd75a35d1f7926d989a10fefd30c37eaa7",
"lessThan": "36c2009d90f2210ef92e6f4f2850e8b57b09e754",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atl1c/atl1c_main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.29",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atl1c/atl1c_main.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:59.733",
"references": [
{
"url": "https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n precursor, before the lockup was captured with a full trace\n elsewhere:\n\n atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n 65535 (0xffff) here is the same value tpd_cons reads back once the\n loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n caught by the soft lockup watchdog with a full stack trace:\n\n watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n Call Trace:\n <TASK>\n __napi_poll+0x32/0x1e0\n napi_threaded_poll_loop+0x286/0x2e0\n napi_threaded_poll+0xfd/0x140\n kthread+0xf7/0x130\n ret_from_fork+0x2da/0x3a0\n ret_from_fork_asm+0x1a/0x30\n </TASK>"
}
],
"lastModified": "2026-10-19T10:19:00.667",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}