SB2026102261 - Infinite loop in Linux kernel atheros atl1c driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102261

SB2026102261 - Infinite loop in Linux kernel atheros atl1c driver

Published: October 22, 2026

Security Bulletin ID SB2026102261
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Infinite loop (CVE-ID: CVE-2026-98489)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to cause a denial of service through a kernel CPU soft lockup.

The vulnerability exists due to an infinite loop with an unreachable exit condition in the Linux kernel atl1c driver's transmit cleanup routine when the hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A remote attacker on the local network can trigger a link reset by rebooting a directly connected network device to cause the cleanup loop to spin indefinitely if the hardware returns the invalid index.


Remediation

Install update from vendor's website.

References