In the Linux kernel, the following vulnerability has been resolved: af_packet: fix integer overflow in prb_calc_retire_blk_tmo()… (CVE-2026-98547)

The Linux kernel's af_packet subsystem had an integer overflow vulnerability in the prb_calc_retire_blk_tmo() function, which calculates a timeout value using 32-bit integer arithmetic. When a user-controlled block size parameter is large (e.g., 256 MiB), the multiplication overflows, producing a negative result. This negative timeout is passed to a high-resolution timer, causing it to expire immediately and then repeatedly fire at the maximum rate. The repeated timer firing holds a lock and causes a CPU to spin in softirq indefinitely, resulting in a denial of service. The overflow was introduced with TPACKET_V3 and became more severe after a change in kernel version 6.18 that used hrtimer for retire operations. The fix involves computing the timeout in 64-bit arithmetic to prevent overflow.

The vulnerability can cause a denial of service by making a CPU core spin indefinitely in a softirq context, holding a kernel lock and effectively hanging the system or degrading performance severely. This occurs when a specially crafted packet ring buffer configuration is used with a large block size, triggering the integer overflow and continuous timer firing. There is no indication of privilege escalation or data corruption from the provided information.

A fix is available that changes the arithmetic in prb_calc_retire_blk_tmo() from 32-bit to 64-bit to prevent integer overflow. Users should update their Linux kernel to a version that includes this fix. No other mitigations are indicated or required according to the advisory.