{"id":"CVE-2026-98917","kind":"vulnerability","aliases":["CVE-2026-98917"],"related":[],"title":"Linux parisc kernel: stack too small, crashes under heavy builds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Increase kernel stack size to 32kb\n\nFor 64-bit Linux kernels, increase the default kernel stack size\n(THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been\ntriggered recently when building the debian vtk9 package with gcc 17:\n\nstackcheck: kworker/u128:0 will most likely overflow kernel stack (sp:179a83af0, stk bottom-top:179a80000-179a84000)\nKernel panic - not syncing: low stack detected by irq handler - check messages\nCPU: 2 UID: 0 PID: 30760 Comm: kworker/u128:0 Tainted: G W 6.18.46-dirty #1 NONE\nTainted: [W]=WARN\nHardware name: 9000/800/rp3440\nWorkqueue: writeback wb_workfn (flush-259:0)\nBacktrace:\n [<000000004022f050>] show_stack+0x70/0x90\n [<000000004022378c>] dump_stack_lvl+0x124/0x190\n [<000000004022382c>] dump_stack+0x34/0x48\n [<000000004020212c>] vpanic+0x204/0x648\n [<00000000402025c4>] panic+0x54/0x58\n [<0000000040232230>] do_cpu_irq_mask+0x3f8/0x440\n [<0000000040227070>] intr_return+0x0/0xc","summary":"On 64-bit parisc Linux kernels the default kernel stack was too small, so deep call chains could overflow it and panic the machine. The fix raises the kernel stack size to 32 kB.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","parisc"],"not_affected_if":["non-parisc-architecture"],"how_to_check":"- `unknown`","fix":"- Move to a Linux kernel release that includes the parisc change raising THREAD_SIZE_ORDER to 32 kB (version unknown from the sources).","status":"open","published_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:25+00:00","updated_at":"2026-10-25T04:58:25+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:58:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel release that includes the parisc change raising THREAD_SIZE_ORDER to 32 kB (version unknown from the sources).","reach":"unknown","title":"Linux parisc kernel: stack too small, crashes under heavy builds","impact":"low","summary":"On 64-bit parisc Linux kernels the default kernel stack was too small, so deep call chains could overflow it and panic the machine. The fix raises the kernel stack size to 32 kB.","category":"infrastructure","nicknames":[],"who_cares":["linux","parisc","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel stack overflow causes a kernel panic and system crash","analyst_note":"Confirm the fixed kernel version and whether the overflow can be triggered by an unprivileged user; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98917.","how_to_check":"- `unknown`","needs_analyst":true,"not_affected_if":["non-parisc-architecture"],"who_is_affected":"Only 64-bit parisc (HP PA-RISC) systems running a Linux kernel are described; the sources report crashes seen when building the Debian vtk9 package with gcc 17. Teams on x86, ARM or other architectures can skip it. Whether an attacker can trigger the overflow remotely is not stated.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3725,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':172C,178C,183C,187C,191C,198C,203C '-2026':12A,15A '-259':166C '-98917':13A,16A '0':111C,142C,147C,167C '000000004020212c':185C '00000000402025c4':189C '000000004022378c':174C '000000004022382c':180C '0000000040227070':200C '000000004022f050':169C '0000000040232230':193C '1':153C '17':108C '179a80000':125C '179a80000-179a84000':124C '179a83af0':119C '179a84000':126C '2':140C '30760':144C '32':53B,87C '32kb':71C '6.18.46':151C '64':22B,73C '9000/800/rp3440':160C 'avoid':92C 'backtrac':168C 'bit':23B,74C 'bottom':122C 'bottom-top':121C 'build':10A,101C 'call':36B 'chain':37B 'check':137C 'comm':145C 'could':38B 'cpu':139C,195C 'crash':7A,94C 'cve':11A,14A 'debian':103C 'deep':35B 'default':28B,79C 'detect':133C 'dirti':152C 'dump':175C,181C 'fix':46B 'flush':165C 'follow':60C 'g':149C 'gcc':107C 'handler':136C 'hardwar':158C 'heavi':9A 'increas':66C,77C 'infrastructur':17B 'intr':201C 'irq':135C,196C 'kb':54B,88C 'kernel':3A,18B,26B,29B,49B,58C,67C,76C,80C,93C,116C,127C 'kworker/u128':110C,146C 'like':114C 'linux':1A,19B,25B,57C,75C 'low':131C 'lvl':177C 'machin':44B 'mask':197C 'messag':138C 'name':159C 'none':154C 'order':85C,90C 'overflow':39B,115C 'packag':105C 'panic':42B,128C,190C 'parisc':2A,20B,24B,65C 'pid':143C 'rais':47B 'recent':99C 'resolv':64C 'return':202C 'show':170C 'size':51B,69C,82C,84C 'small':6A,33B 'sp':118C 'stack':4A,30B,50B,68C,81C,117C,132C,171C,176C,182C 'stackcheck':109C 'stk':120C 'sync':130C 'taint':148C,155C 'thread':83C 'top':123C 'trigger':98C 'uid':141C 'vpanic':186C 'vtk9':104C 'vulner':61C 'w':150C,156C 'warn':157C 'wb':163C 'workfn':164C 'workqueu':161C 'writeback':162C 'x0/0xc':204C 'x124/0x190':179C 'x204/0x648':188C 'x34/0x48':184C 'x3f8/0x440':199C 'x54/0x58':192C 'x70/0x90':173C","nicknames":[],"mitigations":[],"who_affected":"Only 64-bit parisc (HP PA-RISC) systems running a Linux kernel are described; the sources report crashes seen when building the Debian vtk9 package with gcc 17. Teams on x86, ARM or other architectures can skip it. Whether an attacker can trigger the overflow remotely is not stated.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98917","severity":null,"published_at":"2026-10-23T13:17:12+00:00","modified_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}