VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98277: Linux kernel · eth: fbnic: ring the doorbell if a burst ends in a drop

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 490599ab23134962a6d18a024e84541d77bdb999 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 490599ab23134962a6d18a024e84541d77bdb999, 60ef74357a36ed2a102a75bb68d37aa7f305b94e, 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 490599ab23134962a6d18a024e84541d77bdb999, 60ef74357a36ed2a102a75bb68d37aa7f305b94e or 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 9a57bacd574b52b08bc2c600af6a8c7a87049ecf, < 490599ab23134962a6d18a024e84541d77bdb999	Fixed in 490599ab23134962a6d18a024e84541d77bdb999
LinuxLinux	Affected ≥ 9a57bacd574b52b08bc2c600af6a8c7a87049ecf, < 60ef74357a36ed2a102a75bb68d37aa7f305b94e	Fixed in 60ef74357a36ed2a102a75bb68d37aa7f305b94e
LinuxLinux	Affected ≥ 9a57bacd574b52b08bc2c600af6a8c7a87049ecf, < 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9	Fixed in 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9
LinuxLinux	Affected =6.11	Fixed in–

AI-suggested

A fix has been implemented and merged into the Linux kernel. Users should update to the fixed kernel versions containing commits 490599ab23134962a6d18a024e84541d77bdb999, 60ef74357a36ed2a102a75bb68d37aa7f305b94e, or 28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's fbnic network driver causes the hardware doorbell not to ring if a burst of packets ends with a dropped packet. This results in the hardware not being notified of preceding packets, potentially causing the transmit ring to fill up and stall. The issue was reproduced under QEMU with failure injection but has not been observed in real-world scenarios. A fix has been implemented in the Linux kernel.

Impact

If triggered, the vulnerability can cause the network transmit ring to stall because the hardware is not notified of packets ready for transmission when a burst ends with a dropped packet. This can degrade network performance or cause transmission stalls on affected systems using the fbnic driver. However, no real-world exploitation has been observed, and the issue was reproduced only under controlled failure injection in QEMU.

Summary

The Linux kernel fbnic driver function fbnic_tx_map() skips ringing the hardware doorbell and setting the completion request for packets marked with xmit_more, relying on the last packet in a burst to trigger these actions. If the last packet is dropped due to skb_put_padto(), skb_cow_head(), or DMA mapping failure, the doorbell is never rung, leaving descriptors invisible to the hardware until the next transmit event, which may never occur in burst-then-idle workloads. This can cause the transmit ring buffer to fill and stall. The fix ensures the meta descriptor of the last packet is remembered and flushed from error paths, setting the completion request properly to avoid stalling.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:54 UTC

Technical details

References

Community reviews

Related threats