In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every… (CVE-2026-98850)

The Linux kernel vulnerability CVE-2026-98850 involves an integer overflow in the net/packet subsystem's TX_RING byte count. The function tpacket_snd() sums packet lengths in a signed int len_sum, which can overflow negatively after many transmissions, causing sock_sendmsg_nosec() to trigger a BUG due to an unexpected return value. This can lead to a kernel panic if the system is configured to panic on oops, allowing a CAP_NET_RAW user to crash the host kernel. The patch stops sending before the byte count exceeds INT_MAX, preventing the overflow and subsequent kernel panic. A reproducer on arm64 Linux 7.3-rc4 triggered the BUG, which no longer occurs after the fix.

The vulnerability can cause a kernel panic on affected Linux systems when a CAP_NET_RAW user sends enough packets to overflow the TX_RING byte count. This results in a BUG triggered by sock_sendmsg_nosec(), potentially leading to denial of service by crashing the host kernel. There is no indication of code execution or privilege escalation beyond the ability to cause a panic.

A fix has been implemented to prevent the TX_RING byte count from overflowing by stopping before the count would exceed INT_MAX. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. No other mitigation steps are indicated.