CVE-2026-98488

A flaw was found in the Linux kernel's Atheros L1E Gigabit Ethernet (atl1e) network driver. While the network interface hardware is resetting, it can report an unexpected out-of-range status value during transmit packet processing. Because the driver does not properly validate this value, it enters an infinite loop waiting for an unreachable condition, resulting in a soft lockup. This failure causes a Denial of Service (DoS), making the affected system unresponsive.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access, high privileges or control over hardware states, and is constrained to systems equipped with specific Atheros L1E network hardware during link or MAC reset events. Typical enterprise server deployments rarely utilize this consumer-grade Ethernet controller, significantly limiting the real-world attack surface across Red Hat environments. In environments where this hardware is present, triggering the flaw leads solely to a denial of service via a kernel soft lockup, without compromising confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.