CVE-2026-98494
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
net: atl1: corrige el bloqueo blando por lectura fuera de rango de cmb_tpd_next_to_clean
Mismo problema que en atl1c (véase el primer commit de esta serie, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): el hardware puede informar de un cmb_tpd_next_to_clean fuera de rango (visto como 0xffff) mientras el enlace PCIe o la MAC se están reiniciando. Un valor fuera de rango nunca puede alcanzarse y el bucle siguiente giraría indefinidamente. Se trata, en su lugar, como "no hay nada nuevo que limpiar".
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/0f573b0576252d44fb27ab8470ea873bc6408ef3
- https://git.kernel.org/stable/c/43e746821f5f5afbbf68e388bf9fbe221e03bfca
- https://git.kernel.org/stable/c/5d7ac337d37cb97d77e4c910d37746694b606661
- https://git.kernel.org/stable/c/6285919d4c06254d257d24dc980f6332e1984a82
- https://git.kernel.org/stable/c/632cd7b81cb7bab36112f02eb2ee7f7cc1214fb1
- https://git.kernel.org/stable/c/6ab9f61ca851f02ae4398cebaf00735a22e1d6ca
- https://git.kernel.org/stable/c/79e2447b11322c27ef9ac423be0a94efc7691f02
- https://git.kernel.org/stable/c/c55e51d5899e80f9593b26985ed0b89e0c828a5e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98494",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "5d7ac337d37cb97d77e4c910d37746694b606661",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "c55e51d5899e80f9593b26985ed0b89e0c828a5e",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "6ab9f61ca851f02ae4398cebaf00735a22e1d6ca",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "632cd7b81cb7bab36112f02eb2ee7f7cc1214fb1",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "79e2447b11322c27ef9ac423be0a94efc7691f02",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "0f573b0576252d44fb27ab8470ea873bc6408ef3",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "6285919d4c06254d257d24dc980f6332e1984a82",
"versionType": "git"
},
{
"status": "affected",
"version": "f3cc28c797604fa1cda4aef3f250f465de54a0ca",
"lessThan": "43e746821f5f5afbbf68e388bf9fbe221e03bfca",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atlx/atl1.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.21",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/atheros/atlx/atl1.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:00.370",
"references": [
{
"url": "https://git.kernel.org/stable/c/0f573b0576252d44fb27ab8470ea873bc6408ef3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/43e746821f5f5afbbf68e388bf9fbe221e03bfca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d7ac337d37cb97d77e4c910d37746694b606661",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6285919d4c06254d257d24dc980f6332e1984a82",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/632cd7b81cb7bab36112f02eb2ee7f7cc1214fb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ab9f61ca851f02ae4398cebaf00735a22e1d6ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/79e2447b11322c27ef9ac423be0a94efc7691f02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c55e51d5899e80f9593b26985ed0b89e0c828a5e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range cmb_tpd_next_to_clean (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. Treat it as\n\"nothing new to clean\" instead."
}
],
"lastModified": "2026-10-19T10:19:01.687",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}