CVE-2026-98558

A flaw was found in the Linux kernel's networking subsystem. When a central processing unit (CPU) is taken offline, pending network packet buffers held in deferred processing queues are not properly flushed. A privileged local user or administrative action offlining a CPU during network device teardown can cause the kernel to stall indefinitely while waiting for memory pages to be returned, resulting in a Denial of Service (DoS).

Moderate impact has been assigned to this vulnerability because exploitation requires administrative privileges to take CPUs offline and depends on a narrow race condition during network interface teardown. In standard Red Hat Enterprise Linux deployments, dynamic CPU hot-unplugging is uncommon and restricted to privileged system administrators. Consequently, the flaw presents limited real-world exposure, though an affected system could experience a kernel hang and denial of service during device reconfiguration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.