{"api_version":"1","generated_at":"2026-10-21T05:06:12+00:00","cve":"CVE-2026-98489","urls":{"html":"https://cve.report/CVE-2026-98489","api":"https://cve.report/api/cve/CVE-2026-98489.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98489","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98489"},"summary":{"title":"net: atl1c: fix soft lockup on out-of-range tpd_cons read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n  precursor, before the lockup was captured with a full trace\n  elsewhere:\n\n    atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n    atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n    atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n  65535 (0xffff) here is the same value tpd_cons reads back once the\n  loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n  caught by the soft lockup watchdog with a full stack trace:\n\n    watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n    CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n    RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n    Call Trace:\n     <TASK>\n     __napi_poll+0x32/0x1e0\n     napi_threaded_poll_loop+0x286/0x2e0\n     napi_threaded_poll+0xfd/0x140\n     kthread+0xf7/0x130\n     ret_from_fork+0x2da/0x3a0\n     ret_from_fork_asm+0x1a/0x30\n     </TASK>","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:16:59","updated_at":"2026-10-19 10:19:00"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43","name":"https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc","name":"https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841","name":"https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754","name":"https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f","name":"https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16","name":"https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586","name":"https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13","name":"https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98489","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98489","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 5ea2576a4f5ec476f33169fdbe9090d2b038ad13 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 4daf80da0c38b8cd92c111ad96cb38322aabf586 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 57b55367b6e3accc55a989afeaf127063e3614dc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 9f2cc71a2e2799d9c993c73f1bd36507eef6ae43 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 586847400b1168a88917287ac02c2c91a620b841 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 d4ab263e40fcf7cfa38a43ec774067d32eb94e16 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 43250ddd75a35d1f7926d989a10fefd30c37eaa7 36c2009d90f2210ef92e6f4f2850e8b57b09e754 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.29","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.29 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/atheros/atl1c/atl1c_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"5ea2576a4f5ec476f33169fdbe9090d2b038ad13","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"4daf80da0c38b8cd92c111ad96cb38322aabf586","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"57b55367b6e3accc55a989afeaf127063e3614dc","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"9f2cc71a2e2799d9c993c73f1bd36507eef6ae43","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"586847400b1168a88917287ac02c2c91a620b841","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"d4ab263e40fcf7cfa38a43ec774067d32eb94e16","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"},{"lessThan":"36c2009d90f2210ef92e6f4f2850e8b57b09e754","status":"affected","version":"43250ddd75a35d1f7926d989a10fefd30c37eaa7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/atheros/atl1c/atl1c_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"2.6.29","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n  precursor, before the lockup was captured with a full trace\n  elsewhere:\n\n    atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n    atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n    atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n  65535 (0xffff) here is the same value tpd_cons reads back once the\n  loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n  caught by the soft lockup watchdog with a full stack trace:\n\n    watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n    CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n    RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n    Call Trace:\n     <TASK>\n     __napi_poll+0x32/0x1e0\n     napi_threaded_poll_loop+0x286/0x2e0\n     napi_threaded_poll+0xfd/0x140\n     kthread+0xf7/0x130\n     ret_from_fork+0x2da/0x3a0\n     ret_from_fork_asm+0x1a/0x30\n     </TASK>"}],"providerMetadata":{"dateUpdated":"2026-10-19T09:20:26.482Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f"},{"url":"https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13"},{"url":"https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586"},{"url":"https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc"},{"url":"https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43"},{"url":"https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841"},{"url":"https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16"},{"url":"https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754"}],"title":"net: atl1c: fix soft lockup on out-of-range tpd_cons read","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98489","datePublished":"2026-10-18T15:16:16.084Z","dateReserved":"2026-09-25T10:25:14.352Z","dateUpdated":"2026-10-19T09:20:26.482Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:16:59","lastModifiedDate":"2026-10-19 10:19:00","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98489","Ordinal":"1","Title":"net: atl1c: fix soft lockup on out-of-range tpd_cons read","CVE":"CVE-2026-98489","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98489","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n  precursor, before the lockup was captured with a full trace\n  elsewhere:\n\n    atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n    atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n    atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n  65535 (0xffff) here is the same value tpd_cons reads back once the\n  loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n  caught by the soft lockup watchdog with a full stack trace:\n\n    watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n    CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n    RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n    Call Trace:\n     <TASK>\n     __napi_poll+0x32/0x1e0\n     napi_threaded_poll_loop+0x286/0x2e0\n     napi_threaded_poll+0xfd/0x140\n     kthread+0xf7/0x130\n     ret_from_fork+0x2da/0x3a0\n     ret_from_fork_asm+0x1a/0x30\n     </TASK>","Type":"Description","Title":"net: atl1c: fix soft lockup on out-of-range tpd_cons read"}]}}}