All vulnerabilities
CVE-2026-98233

Linux: net/packet: clear RX owner on VNET header error

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2daa618e7ff19eefcbda281bc4c5998c4140f9cfAlso 23cd30498891d29a69ec9b75bd92f8a0f21f1342, 49a48a5aaf85fe69d2dc3fb334b4854fadf44e39 and 7 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2daa618e7ff19eefcbda281bc4c5998c4140f9cfLinuxCVE List
  • 23cd30498891d29a69ec9b75bd92f8a0f21f1342LinuxCVE List
  • 49a48a5aaf85fe69d2dc3fb334b4854fadf44e39LinuxCVE List
  • 805edbdcb8681da5f7ee43b3c3c809f7a8c31208LinuxCVE List
  • 693209a237fc548791cf402441db8b68d1da7d38LinuxCVE List
  • 33ff111d7ba3beb86e28938d6382bb5beabd865aLinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error

Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed.

With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet.

Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

Text from CVE List

Affected versions 26

  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before bb10a0084c03a94364aeec542beddc5d49b59f59CVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before b8c0cb3069058c2d67b5c7c833b2833381ecffdcCVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 2daa618e7ff19eefcbda281bc4c5998c4140f9cfCVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 23cd30498891d29a69ec9b75bd92f8a0f21f1342CVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 49a48a5aaf85fe69d2dc3fb334b4854fadf44e39CVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 805edbdcb8681da5f7ee43b3c3c809f7a8c31208CVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 693209a237fc548791cf402441db8b68d1da7d38CVE List
  • Linuxaffected: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 before 33ff111d7ba3beb86e28938d6382bb5beabd865aCVE List
  • Linuxaffected: 2975472e042e0bbfeeabddc5023cb8c011ec5a07CVE List
  • Linuxaffected: 6fb0e4385928900ccb8697748555b3f54bba5193CVE List
  • Linuxaffected: 86137342fd4cf52882842aa8d1318b2661f08e8aCVE List
  • Linuxaffected: b06e4d3ed4044c2facf10a511d809f9aa29d960eCVE List
  • Linuxaffected: 4.14.175 before 4.15CVE List
  • Linuxaffected: 4.19.114 before 4.20CVE List
  • Linuxaffected: 5.4.29 before 5.5CVE List
  • Linuxaffected: 5.5.14 before 5.6CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8