Incorrect calculation in Linux kernel - CVE-2026-98051

Vulnerability details

The vulnerability allows a local user to initiate a transmission without ensuring that consecutive descriptor slots are available.

The vulnerability exists due to incorrect loop initialization in tx_spb_ring_full() when checking descriptor slot availability for a new transmission. A local user can trigger a transmission after the function repeatedly checks the same descriptor slot instead of consecutive slots.

Affected software

How to mitigate CVE-2026-98051

External References

• https://git.kernel.org/stable/c/0c5cf62e72d7a666ee4da757e122dc1600df1ecc
• https://git.kernel.org/stable/c/5df7ecd302488287665ab9767bacba7ed7e2842f
• https://git.kernel.org/stable/c/a8bddab54aa68b407f12294acb05bd552fb6a492
• https://git.kernel.org/stable/c/f7f7a16dd46ace4e221336a184c7806f7de19547

Related Security Bulletins

• Incorrect calculation in Linux kernel broadcom asp2 driver