{"id":"CVE-2026-98494","kind":"vulnerability","aliases":["CVE-2026-98494"],"related":[],"title":"Linux kernel atl1 driver: soft lockup on out-of-range hardware read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range cmb_tpd_next_to_clean (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. Treat it as\n\"nothing new to clean\" instead.","summary":"The atl1 Ethernet driver in the Linux kernel can spin forever in a loop when the hardware reports an out-of-range transmit-cleanup index during a PCIe link or MAC reset. The fix treats such a value as nothing new to clean, so the kernel no longer hangs.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["atl1","ethernet-driver","infrastructure","linux-kernel"],"not_affected_if":["no-atl1-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:38+00:00","updated_at":"2026-10-25T05:25:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel atl1 driver: soft lockup on out-of-range hardware read","impact":"low","summary":"The atl1 Ethernet driver in the Linux kernel can spin forever in a loop when the hardware reports an out-of-range transmit-cleanup index during a PCIe link or MAC reset. The fix treats such a value as nothing new to clean, so the kernel no longer hangs.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","atl1","ethernet-driver"],"confidence":0.6,"needs_auth":"no","worst_case":"local denial of service via kernel soft lockup","analyst_note":"Find the affected kernel version ranges and the fixed stable releases in the NVD entry or the upstream kernel commit for atl1.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-atl1-hardware"],"who_is_affected":"Systems running a Linux kernel that includes the atl1 Ethernet driver (Atheros L1 NICs) and that have not yet received the upstream fix. The sources do not give affected kernel version ranges or say how often the hardware reports this value. Hosts without atl1 hardware are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000577,"input_tokens":3418,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98494':16A,19A '0xffff':145C 'atl1':3A,20B,29B,90C 'atl1c':108C,117C 'clean':72B,103C,142C,175C 'cleanup':53B 'cmb':99C,138C 'commit':112C 'con':127C 'cve':14A,17A 'driver':4A,23B,31B 'ethernet':22B,30B 'ethernet-driv':21B 'first':111C 'fix':63B,91C,118C 'follow':84C 'forev':38B,168C 'hang':78B 'hardwar':12A,44B,130C 'index':54B 'infrastructur':24B 'instead':176C 'issu':106C 'kernel':2A,27B,35B,75B,82C 'link':58B 'link/mac':149C 'linux':1A,26B,34B,81C 'linux-kernel':25B 'lockup':6A,93C,120C 'longer':77B 'loop':41B,164C 'mac':60B 'net':89C,116C 'never':159C 'new':70B,173C 'next':101C,140C 'noth':69B,172C 'out-of-rang':8A,47B,95C,122C,134C,153C 'pcie':57B,148C 'rang':11A,50B,98C,125C,137C,156C 'reach':161C 'read':13A,104C,128C 'report':45B,132C 'reset':61B,151C 'resolv':88C 'see':109C 'seen':143C 'seri':115C 'soft':5A,92C,119C 'spin':37B,167C 'tpd':100C,126C,139C 'transmit':52B 'transmit-cleanup':51B 'treat':64B,169C 'valu':67B,157C 'vulner':85C 'would':166C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes the atl1 Ethernet driver (Atheros L1 NICs) and that have not yet received the upstream fix. The sources do not give affected kernel version ranges or say how often the hardware reports this value. Hosts without atl1 hardware are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98494","severity":null,"published_at":"2026-10-18T16:17:00+00:00","modified_at":"2026-10-19T10:19:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}