CVE-2026-98494

What it actually does

The atl1 network driver does not validate the cmb_tpd_next_to_clean index read from hardware, allowing an out-of-range value (such as 0xffff) during PCIe or MAC reset to cause an unbounded loop in the transmit cleanup path.

Why it matters to the business

Systems using the affected network hardware may experience soft lockups or unresponsiveness during link resets, leading to degraded network availability and potential need for manual intervention or reboot.

How an attack unfolds

No remote or local attacker exploitation is known; the condition occurs when hardware reports an invalid index during its own reset sequence, independent of attacker input.

How to fix it

Update the Linux kernel to a version containing the fix for this driver issue; apply the same class of bounds check already present in the related atl1c driver.

How to confirm the fix worked

Confirm the kernel source contains the updated atl1 driver that treats out-of-range cmb_tpd_next_to_clean as no work to clean; test link reset sequences under load to verify absence of soft lockup warnings.

How to detect it

Search kernel logs for soft lockup or watchdog messages mentioning atl1 or cmb_tpd_next_to_clean; no post-exploitation artifacts are expected because the issue is not attacker-triggered.

What your security team should do

• Prioritize kernel updates on systems using atl1-based adapters within normal patching cycles given low EPSS and absence from KEV.
• Monitor vendor advisories for backported fixes in distribution kernels.
• Review dmesg or kernel logs for repeated soft lockup messages referencing atl1 during link flaps as a sign of exposure.