{"id":"CVE-2026-98850","kind":"vulnerability","aliases":["CVE-2026-98850"],"related":[],"title":"Linux kernel: packet TX ring overflow lets a CAP_NET_RAW user panic the host","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\n\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\n\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops.","summary":"A flaw in the Linux kernel's AF_PACKET TX ring code lets the signed byte counter wrap negative when a process keeps sending frames, which trips a kernel BUG. A local user holding CAP_NET_RAW can crash the host, and on systems set to panic on oops that takes the whole machine down.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","self-hosted"],"not_affected_if":["no-cap-net-raw-users"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit \"net/packet: prevent TX_RING byte count overflow\" (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:04+00:00","updated_at":"2026-10-25T05:13:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:13:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit \"net/packet: prevent TX_RING byte count overflow\" (version unknown from the sources)","reach":"local","title":"Linux kernel: packet TX ring overflow lets a CAP_NET_RAW user panic the host","impact":"medium","summary":"A flaw in the Linux kernel's AF_PACKET TX ring code lets the signed byte counter wrap negative when a process keeps sending frames, which trips a kernel BUG. A local user holding CAP_NET_RAW can crash the host, and on systems set to panic on oops that takes the whole machine down.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Host kernel panics via BUG, taking down the whole machine","analyst_note":"Find the affected and fixed kernel version range and distro advisories from the NVD entry and the upstream commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-cap-net-raw-users"],"who_is_affected":"Systems running a Linux kernel with AF_PACKET TX ring support that has not received the fix. Exposure needs a process with CAP_NET_RAW that uses TPACKET_V2 TX rings; the sources do not say which distributions or kernel versions are affected. Hosts without untrusted CAP_NET_RAW holders are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3604,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98850':18A,21A '0xfffffdef':165C '65007':161C '65535':155C '65536':154C '7.3':240C 'add':111C 'af':35B 'arm64':236C 'block':131C 'bound':136C 'bug':57B,180C,233C 'build':237C 'byte':43B,96C,156C,162C,206C 'call':133C,223C 'cap':9A,62B,189C 'chang':244C 'code':39B 'complet':125C 'concurr':127C 'configur':183C 'count':97C,207C,214C,253C 'counter':44B 'crash':66B 'cve':16A,19A 'drain':101C 'eiocbqueu':167C 'enough':142C 'everi':102C 'exceed':208C 'expect':250C 'flaw':29B 'follow':87C,158C 'frame':52B,105C,126C,157C,163C,202C,217C 'hold':61B 'holder':192C 'host':15A,27B,68B,196C 'imposs':175C 'infrastructur':22B 'int':119C,209C 'keep':50B 'kernel':2A,23B,33B,56B,85C,197C 'later':221C 'leav':215C 'len':120C,145C 'length':115C 'let':7A,40B 'linux':1A,24B,32B,84C,239C 'local':59B 'machin':81B 'make':204C 'max':210C 'negat':46B,150C 'net':10A,63B,190C 'net/packet':92C 'next':201C 'nosec':170C 'oop':76B,187C,256C 'overflow':6A,98C 'packet':3A,36B,114C 'panic':13A,74B,185C,194C 'particular':153C 'pend':218C 'posit':212C,251C 'prevent':93C 'process':49B 'produc':164C 'rang':151C 'raw':11A,64B,191C 'rc4':241C 'recycl':124C 'reproduc':230C,247C 'request':104C 'resolv':91C 'return':176C,248C 'ring':5A,38B,95C,109C,139C 'self':26B 'self-host':25B 'send':51B,103C,132C,222C 'sendmsg':169C 'set':72B 'short':213C,252C 'sign':42B,118C 'singl':130C 'size':140C 'snd':100C 'sock':168C 'stop':198C 'success':143C 'sum':121C,146C 'system':71B,182C 'take':78B 'thread':227C 'tpacket':99C,228C 'transmiss':144C 'treat':171C 'trigger':178C,231C 'trip':54B 'two':226C 'two-thread':225C 'tx':4A,37B,94C,108C 'user':12A,60B 'userspac':122C 'v2':229C 'valid':113C 'vulner':88C 'whole':80B 'without':254C 'would':203C 'wrap':45B,147C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with AF_PACKET TX ring support that has not received the fix. Exposure needs a process with CAP_NET_RAW that uses TPACKET_V2 TX rings; the sources do not say which distributions or kernel versions are affected. Hosts without untrusted CAP_NET_RAW holders are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98850","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}