SB2026100751 - Integer overflow in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Integer overflow (CVE-ID: CVE-2026-98317)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause managed neighbour probes to be scheduled with zero delay.

The vulnerability exists due to integer overflow and missing range validation in the neighbour probe interval configuration when processing interval values supplied through netlink or sysctl. A local user can supply an out-of-range probe interval to cause managed neighbour probes to be scheduled with zero delay.

The signed-integer overflow path occurs when HZ is greater than 1000, including on Alpha and MIPS.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722
• https://git.kernel.org/stable/c/8550b50e49b01b572e653e572f24ddd73949aa74
• https://git.kernel.org/stable/c/982c7f66c04134b77126edbfd8a63ecd6928cfd9