Incorrect calculation in Linux kernel - CVE-2026-98617

Vulnerability identifier: #VU156925

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98617

CWE-ID: CWE-682

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially cause a denial of service by disrupting receive queue processing.

The vulnerability exists due to incorrect calculation of NAPI vector indices in the Linux kernel fbnic driver's queue management operations when managing receive queues with standalone transmit vectors present. A local privileged user can trigger receive queue reconfiguration to make queue operations use transmit NAPI vectors instead of the corresponding receive vectors, potentially disrupting network processing.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/1fb569cf3bf97e552f465b2c719e36b48ae7c18b
• https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e

• Incorrect calculation in Linux kernel meta fbnic driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more