All vulnerabilities
CVE-2026-98489

Linux: net: atl1c: fix soft lockup on out-of-range tpd_cons read

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5ea2576a4f5ec476f33169fdbe9090d2b038ad13Also 4daf80da0c38b8cd92c111ad96cb38322aabf586, 57b55367b6e3accc55a989afeaf127063e3614dc and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5ea2576a4f5ec476f33169fdbe9090d2b038ad13LinuxCVE List
  • 4daf80da0c38b8cd92c111ad96cb38322aabf586LinuxCVE List
  • 57b55367b6e3accc55a989afeaf127063e3614dcLinuxCVE List
  • 9f2cc71a2e2799d9c993c73f1bd36507eef6ae43LinuxCVE List
  • 586847400b1168a88917287ac02c2c91a620b841LinuxCVE List
  • 36c2009d90f2210ef92e6f4f2850e8b57b09e754LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: atl1c: fix soft lockup on out-of-range tpd_cons read

The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead.

Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to:

  • Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap

precursor, before the lockup was captured with a full trace elsewhere:

atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>

65535 (0xffff) here is the same value tpd_cons reads back once the loop below gets stuck.

  • Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time

caught by the soft lockup watchdog with a full stack trace:

watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329] CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy) RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c] Call Trace: <TASK> __napi_poll+0x32/0x1e0 napi_threaded_poll_loop+0x286/0x2e0 napi_threaded_poll+0xfd/0x140 kthread+0xf7/0x130 ret_from_fork+0x2da/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK>

Text from CVE List

Affected versions 18

  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before e7acd4cdeccbcdfd407adeb72b1eba14d1145b6fCVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 5ea2576a4f5ec476f33169fdbe9090d2b038ad13CVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 4daf80da0c38b8cd92c111ad96cb38322aabf586CVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 57b55367b6e3accc55a989afeaf127063e3614dcCVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 9f2cc71a2e2799d9c993c73f1bd36507eef6ae43CVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 586847400b1168a88917287ac02c2c91a620b841CVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before d4ab263e40fcf7cfa38a43ec774067d32eb94e16CVE List
  • Linuxaffected: 43250ddd75a35d1f7926d989a10fefd30c37eaa7 before 36c2009d90f2210ef92e6f4f2850e8b57b09e754CVE List
  • Linuxaffected: 2.6.29CVE List
  • Linuxunaffected: all versions before 2.6.29CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8