VulnerabilityPublished 18 Oct 2026

CVE-2026-98488: Linux kernel · net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

Source GCVE Database

Authoritative record:CVE-2026-98488· Medium

Not known to be exploited · fixed in ca862b1a4af7eac19429ca7ab92625f94ff4a46c : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ca862b1a4af7eac19429ca7ab92625f94ff4a46c, a277422d194c62daa1b961f5f739689e53fe7301, 374bf9e4b90f979e052332c4faca2d745c491a12 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-5jr3-mhw7-v4fq

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < ca862b1a4af7eac19429ca7ab92625f94ff4a46c	Fixed in ca862b1a4af7eac19429ca7ab92625f94ff4a46c
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < a277422d194c62daa1b961f5f739689e53fe7301	Fixed in a277422d194c62daa1b961f5f739689e53fe7301
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < 374bf9e4b90f979e052332c4faca2d745c491a12	Fixed in 374bf9e4b90f979e052332c4faca2d745c491a12
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < 34bc747a61bef572244b01b095552b629cd8d2a2	Fixed in 34bc747a61bef572244b01b095552b629cd8d2a2
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < 4bbb44075bd3e773d61706882ab923ece8b3b519	Fixed in 4bbb44075bd3e773d61706882ab923ece8b3b519
LinuxLinux	Affected ≥ a6a5325239c20202e18e21e94291bccc659fbf9e, < 4b7161804d8f31227551901f93947bb4eea4690b	Fixed in 4b7161804d8f31227551901f93947bb4eea4690b

AI-suggested

A fix has been implemented in the Linux kernel to handle out-of-range hw_next_to_clean values correctly by treating them as no new data to clean, preventing the soft lockup. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated in the input data, so check the vendor advisory or Linux kernel changelogs for the exact fixed version.

Description

A vulnerability in the Linux kernel's atl1e network driver caused a soft lockup due to an out-of-range hardware pointer read during PCIe link or MAC reset. This issue was fixed by treating the out-of-range value as no new data to clean, preventing an infinite loop.

References

Community reviews

Loading reviews…