CVE-2026-98489
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A network card driver bug can freeze some computers when hardware resets occur, potentially interrupting network services until the system is updated.
- Exploitation
- Other
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
In the atl1c network driver, hardware reporting an out-of-range tpd_cons value (0xffff) during PCIe link or MAC reset causes the tx cleanup loop in atl1c_clean_tx to spin indefinitely, resulting in a soft lockup.
Why it matters to the business
Systems using affected Qualcomm Atheros AR8151 NICs may experience kernel soft lockups and system unresponsiveness during link flaps or resets on connected devices, leading to network downtime and requiring manual intervention or reboots.
How an attack unfolds
An attacker with the ability to trigger repeated link flaps or resets on a connected device (such as a Mikrotik CCR2004) can induce the out-of-range tpd_cons read, causing the driver to enter an infinite loop and hang the CPU in the napi poll thread.
How to fix it
Update the Linux kernel to a version that includes the resolution for the out-of-range tpd_cons handling in the atl1c driver.
How to confirm the fix worked
Review kernel logs after patching to confirm absence of soft lockup traces in atl1c_clean_tx and verify that tpd_cons reads outside valid range are now treated as no-op cleanups.
Typical attack path
- Trigger link flap or reset on connected PCIe device
- Hardware reports out-of-range tpd_cons (0xffff)
- atl1c_clean_tx enters infinite spin loop
- Soft lockup watchdog or NETDEV WATCHDOG triggers system hang
How to detect it
Search kernel logs and dmesg for soft lockup messages, napi poll traces, or NETDEV WATCHDOG entries referencing atl1c, tpd_cons reads of 0xffff, or transmit queue timeouts on atl1c interfaces.
- atl1c_clean_tx
- tpd_cons
- soft lockup - CPU
- NETDEV WATCHDOG: transmit queue timed out
- MAC state machine can't be idle
- napi/eth%d
What your security team should do
- Apply the kernel patch resolving the atl1c tpd_cons issue as soon as available
- Monitor systems with AR8151-based NICs for link flap precursors and watchdog events
- Temporarily disable affected interfaces in high-availability environments until patched
The record
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead. Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to: - Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap precursor, before the lockup was captured with a full trace elsewhere: atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex> 65535 (0xffff) here is the same value tpd_cons reads back once the loop below gets stuck. - Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time caught by the soft lockup watchdog with a full stack trace: watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329] CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy) RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c] Call Trace: <TASK> __napi_poll+0x32/0x1e0 napi_threaded_poll_loop+0x286/0x2e0 napi_threaded_poll+0xfd/0x140 kthread+0xf7/0x130 ret_from_fork+0x2da/0x3a0 ret_from_fork_asm+0x1a/0x30 </TASK>
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|