In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as… (CVE-2026-98488)

The Linux kernel vulnerability CVE-2026-98488 involves the atl1e network driver where the hardware can report an out-of-range hw_next_to_clean value (e.g., 0xffff) during PCIe link or MAC reset. This out-of-range value leads to an infinite loop (soft lockup) because the driver attempts to process a pointer that should never be reached. The fix treats such out-of-range values as indicating no new data to clean, thus avoiding the infinite loop. This issue is similar to a previously addressed problem in the atl1c driver.

The vulnerability causes a soft lockup in the Linux kernel network driver, which can lead to system instability or denial of network functionality due to the driver spinning indefinitely. There is no indication of code execution or privilege escalation from this issue.

A fix has been implemented in the Linux kernel to handle out-of-range hw_next_to_clean values correctly by treating them as no new data to clean, preventing the soft lockup. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated in the input data, so check the vendor advisory or Linux kernel changelogs for the exact fixed version.