Cloudanix VulnDB

CVE-2026-98233

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug can cause some network packets to be silently lost on systems that use a particular packet capture mechanism.

Exploitation
Adjacent Network
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw leaves a TPACKET_V2 ring slot marked as owned after a virtio-net header conversion failure in tpacket_rcv, preventing reuse of the single slot in a one-frame ring and causing subsequent valid packets to be dropped.

Why it matters to the business

Network-intensive Linux systems using AF_PACKET with TPACKET_V2 rings may experience unexpected packet loss and degraded network performance until the kernel is updated.

How an attack unfolds

An attacker sends crafted UDP GSO packets that trigger the VNET header conversion error path in tpacket_rcv, leaving the ring slot permanently claimed and starving the ring of available buffers for legitimate traffic.

How to fix it

Update the Linux kernel to a version containing the fix that clears the RX ownership bit on VNET header error paths in net/packet.

How to confirm the fix worked

Confirm the presence of the upstream commit that clears ownership on the error path and verify that TPACKET_V2 rings no longer drop packets after header conversion failures.

Typical attack path

  1. Identify a target system using TPACKET_V2 rings with a single frame.
  2. Transmit unsupported UDP GSO packets to force header conversion failure.
  3. Observe sustained packet drops on the affected ring due to the un-cleared ownership bit.

How to detect it

Review kernel logs and network stack traces for repeated packet drops on TPACKET_V2 rings immediately following virtio-net header processing errors; correlate with traffic containing UDP GSO frames.

What your security team should do

  • Prioritize kernel updates on systems that rely on AF_PACKET TPACKET_V2 rings.
  • Monitor kernel changelogs for the referenced net/packet fix and schedule rollout.
  • Test network performance after patching to confirm ring slot reuse behaves correctly.

The record

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed. With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet. Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

Affected packages

Ecosystem Package Introduced Fixed