Infinite loop in Linux kernel - CVE-2026-98489

Vulnerability identifier: #VU156789

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98489

CWE-ID: CWE-835

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to cause a denial of service through a kernel CPU soft lockup.

The vulnerability exists due to an infinite loop with an unreachable exit condition in the Linux kernel atl1c driver's transmit cleanup routine when the hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A remote attacker on the local network can trigger a link reset by rebooting a directly connected network device to cause the cleanup loop to spin indefinitely if the hardware returns the invalid index.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754
• https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586
• https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc
• https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841
• https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13
• https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43
• https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16
• https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f

• Infinite loop in Linux kernel atheros atl1c driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more