{"id":"CVE-2026-98488","kind":"vulnerability","aliases":["CVE-2026-98488"],"related":[],"title":"Linux atl1e NIC driver: out-of-range hardware read causes soft lockup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range hw_next_to_clean (seen as 0xffff) while\nthe PCIe link/MAC is resetting. An out-of-range value can never be\nreached and the loop below would spin forever. Treat it as \"nothing\nnew to clean\" instead.","summary":"The atl1e Ethernet driver in the Linux kernel can spin forever when the network card reports an impossible transmit-ring index during a PCIe link or MAC reset. The result is a soft lockup that stalls the CPU, a denial of service rather than code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["atheros-l1e-nic","infrastructure","kernel","linux"],"not_affected_if":["no-atl1e-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the atl1e fix from this series; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:16:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:44+00:00","updated_at":"2026-10-25T05:25:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the atl1e fix from this series; the exact fixed version is unknown from the sources.","reach":"local","title":"Linux atl1e NIC driver: out-of-range hardware read causes soft lockup","impact":"low","summary":"The atl1e Ethernet driver in the Linux kernel can spin forever when the network card reports an impossible transmit-ring index during a PCIe link or MAC reset. The result is a soft lockup that stalls the CPU, a denial of service rather than code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","atheros-l1e-nic"],"confidence":0.6,"needs_auth":"no","worst_case":"Denial of service: a CPU core locks up while the NIC resets","analyst_note":"Find the fixed kernel version and the affected version range in the upstream kernel commit or the NVD entry for CVE-2026-98488.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-atl1e-hardware"],"who_is_affected":"Systems running a Linux kernel with the atl1e driver, which supports Atheros L1E gigabit Ethernet adapters. Hosts without that hardware are not exposed to this driver path, and the sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3410,"output_tokens":495,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98488':16A,19A '0xffff':138C 'athero':21B 'atheros-l1e-nic':20B 'atl1c':102C,111C 'atl1e':2A,28B,85C 'card':41B 'caus':11A 'clean':97C,135C,168C 'code':72B 'commit':106C 'con':121C 'cpu':65B 'cve':14A,17A 'denial':67B 'driver':4A,30B 'ethernet':29B 'execut':73B 'first':105C 'fix':86C,112C 'follow':79C 'forev':37B,161C 'hardwar':9A,124C 'hw':94C,132C 'imposs':44B 'index':48B 'infrastructur':24B 'instead':169C 'issu':100C 'kernel':25B,34B,77C 'l1e':22B 'link':52B 'link/mac':142C 'linux':1A,26B,33B,76C 'lockup':13A,61B,88C,114C 'loop':157C 'mac':54B 'net':84C,110C 'network':40B 'never':152C 'new':166C 'next':95C,133C 'nic':3A,23B 'noth':165C 'out-of-rang':5A,90C,116C,128C,146C 'pcie':51B,141C 'rang':8A,93C,119C,131C,149C 'rather':70B 'reach':154C 'read':10A,98C,122C 'report':42B,126C 'reset':55B,144C 'resolv':83C 'result':57B 'ring':47B 'see':103C 'seen':136C 'seri':109C 'servic':69B 'soft':12A,60B,87C,113C 'spin':36B,160C 'stall':63B 'tpd':120C 'transmit':46B 'transmit-r':45B 'treat':162C 'valu':150C 'vulner':80C 'would':159C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the atl1e driver, which supports Atheros L1E gigabit Ethernet adapters. Hosts without that hardware are not exposed to this driver path, and the sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98488","severity":null,"published_at":"2026-10-18T16:16:59+00:00","modified_at":"2026-10-19T10:19:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}