CVE-2026-98547: Linux kernel · af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in eb5b3838b9200dac04bfe33483db0ee8287456fb : patch Linux kernel soon.
Data as of 26 Oct 2026, 12:55 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in eb5b3838b9200dac04bfe33483db0ee8287456fb, be1aacff399d519cc48d6b34354a54dd79041140, b2bcc6a254d6f27823a56787668ae4ee8cdb6e71 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in multiple Linux kernel commits. Users should update their Linux kernel to a version including these fixes. The vulnerability requires CAP_NET_RAW capability and specific network conditions to trigger, so limiting untrusted access to raw sockets can reduce risk. No other specific mitigations are indicated by the vendor advisory.
Description
CVE-2026-98547 is a vulnerability in the Linux kernel's af_packet subsystem where an integer overflow occurs in the function prb_calc_retire_blk_tmo(). This overflow leads to a negative timeout value being used for a high-resolution timer, causing the timer to fire at maximum rate indefinitely. This results in a CPU spinning in softirq context, holding a lock and potentially causing a denial of service. The issue arises from 32-bit integer arithmetic overflow when calculating block size timeouts with user-controlled parameters. The vulnerability has been fixed by changing the calculation to use 64-bit arithmetic.
References
- git.kernel.org/stable/c/02afd75649a4e001031ed82153a5c39312ec0737 (opens in a new tab)
- git.kernel.org/stable/c/eb5b3838b9200dac04bfe33483db0ee8287456fb (opens in a new tab)
- git.kernel.org/stable/c/297acc571d5813db76b147c745b91031d5f9c960 (opens in a new tab)
- git.kernel.org/stable/c/be1aacff399d519cc48d6b34354a54dd79041140 (opens in a new tab)
- git.kernel.org/stable/c/b2bcc6a254d6f27823a56787668ae4ee8cdb6e71 (opens in a new tab)
- git.kernel.org/stable/c/6279211e7d2456ecd195d236c9ee5e5c6fa5a17a (opens in a new tab)
- git.kernel.org/stable/c/218a944b9e035d4b47d59c69af6ca13319da15fb (opens in a new tab)
- git.kernel.org/stable/c/56d82862a0a243ac14ba11b6d7b57ddc2d064b95 (opens in a new tab)