All vulnerabilities
CVE-2026-98488

Linux: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4bbb44075bd3e773d61706882ab923ece8b3b519Also 34bc747a61bef572244b01b095552b629cd8d2a2, 1d8c85359b5075c7937925b673add7ed00e57ec8 and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4bbb44075bd3e773d61706882ab923ece8b3b519LinuxCVE List
  • 34bc747a61bef572244b01b095552b629cd8d2a2LinuxCVE List
  • 1d8c85359b5075c7937925b673add7ed00e57ec8LinuxCVE List
  • 4b7161804d8f31227551901f93947bb4eea4690bLinuxCVE List
  • 3a7d9271b37c80fb7db04aff3bc5621cfdaf9beeLinuxCVE List
  • 374bf9e4b90f979e052332c4faca2d745c491a12LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range hw_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead.

Text from CVE List

Affected versions 18

  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before ca862b1a4af7eac19429ca7ab92625f94ff4a46cCVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 4bbb44075bd3e773d61706882ab923ece8b3b519CVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 34bc747a61bef572244b01b095552b629cd8d2a2CVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 1d8c85359b5075c7937925b673add7ed00e57ec8CVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before a277422d194c62daa1b961f5f739689e53fe7301CVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 4b7161804d8f31227551901f93947bb4eea4690bCVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 3a7d9271b37c80fb7db04aff3bc5621cfdaf9beeCVE List
  • Linuxaffected: a6a5325239c20202e18e21e94291bccc659fbf9e before 374bf9e4b90f979e052332c4faca2d745c491a12CVE List
  • Linuxaffected: 2.6.27CVE List
  • Linuxunaffected: all versions before 2.6.27CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8