CVE-2026-98489

A flaw was found in the Linux kernel's atl1c network driver. When an interface experiences a link reset or link flapping, the hardware can return an out-of-range descriptor value that the driver fails to validate. An adjacent entity capable of triggering network link state changes can exploit this behavior, causing the transmit cleanup routine to enter an infinite loop. This failure locks up the CPU, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because exploitation requires the host to possess specific Qualcomm Atheros network hardware and is restricted to adjacent network vectors. While an adjacent actor capable of forcing link renegotiation can induce an unrecoverable kernel soft lockup that disrupts system availability, the issue cannot lead to unauthorized data disclosure or code execution. Furthermore, enterprise server platforms rarely employ these consumer-grade Ethernet controllers, substantially limiting real-world exposure across standard Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.