CVE-2026-98494

A flaw was found in the Linux kernel's atl1 network driver. During a PCIe link or hardware reset, the network adapter can return an out-of-range status value that the driver fails to validate properly. This condition can trap the driver in an infinite loop, resulting in a kernel soft lockup and leading to a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because exploitation requires a system equipped with specific Atheros L1 network hardware undergoing a link or interface reset, limiting the attack surface to environments with this physical or emulated hardware. An attacker with privileged access would need to trigger hardware reset conditions to induce a persistent hang. As this driver is not commonly used in enterprise server deployments and cannot be exploited remotely across standard network traffic, the overall risk to most Red Hat environments is reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.