{"id":"CVE-2026-98965","kind":"vulnerability","aliases":["CVE-2026-98965"],"related":[],"title":"Linux kernel: Intel E810 driver race can crash arm64 hosts under load","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql->num_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql->num_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n  BUG_ON(count > num_queued - dql->num_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user's workload, which\npreviously reproduced the issue reliably.\n\n  kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed().","summary":"The ice network driver for Intel E810 adapters used a relaxed MMIO write for the transmit doorbell, so on arm64 the NIC could start sending before queue accounting was visible. The accounting check then hits a BUG_ON and crashes the kernel, a denial of service rather than code execution.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","ice-driver","infrastructure","intel-e810","linux-kernel"],"not_affected_if":["no-e810-hardware"],"how_to_check":"- `uname -r` and compare against the kernel build that carries the upstream ice fix\n- `lspci | grep -i e810` to confirm an Intel E810 controller is present\n- `uname -m` to confirm the host is arm64 (aarch64)","fix":"- Update the Linux kernel to a release that includes the upstream fix restoring writel() in the ice Tx doorbell path (version unknown from sources)\n- Until patched, unknown workaround from sources","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:32+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:56:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix restoring writel() in the ice Tx doorbell path (version unknown from sources)\n- Until patched, unknown workaround from sources","reach":"network","title":"Linux kernel: Intel E810 driver race can crash arm64 hosts under load","impact":"low","summary":"The ice network driver for Intel E810 adapters used a relaxed MMIO write for the transmit doorbell, so on arm64 the NIC could start sending before queue accounting was visible. The accounting check then hits a BUG_ON and crashes the kernel, a denial of service rather than code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm64","intel-e810","ice-driver"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel crashes under sustained network load, causing host denial of service","analyst_note":"Confirm fixed kernel version and whether x86 is affected, using the NVD entry CVE-2026-98965 and the upstream ice driver commit.","how_to_check":"- `uname -r` and compare against the kernel build that carries the upstream ice fix\n- `lspci | grep -i e810` to confirm an Intel E810 controller is present\n- `uname -m` to confirm the host is arm64 (aarch64)","needs_analyst":true,"not_affected_if":["no-e810-hardware"],"who_is_affected":"Hosts running the Linux kernel ice driver with an Intel E810 Ethernet controller, reported on arm64 machines under sustained network load. x86 systems and hosts without E810 hardware are not described as affected. Crash requires heavy Tx traffic to trigger the race.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4001,"output_tokens":628,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':339C,346C,353C,359C,364C,369C '-2026':14A,17A '-98965':15A,18A '00000000f2000800':333C '02':296C '1':334C '99':328C 'account':57B,61B,100C,150C 'action':368C 'adapt':37B 'add':380C 'allow':139C 'arm64':9A,19B,49B,174C,299C 'begin':143C,158C,203C 'behaviour':374C 'bug':66B,247C,251C,325C,332C 'byte':107C,234C 'call':349C 'ccde82e90946':378C 'chang':388C 'check':62B 'clean':343C 'code':78B 'commit':377C 'complet':226C,237C,258C,338C,352C 'control':289C 'corpor':287C 'could':52B 'count':253C 'crash':8A,69B,268C,312C 'current':164C 'cve':13A,16A 'denial':73B 'descriptor':160C,205C 'detect':228C 'doorbel':46B,97C,168C 'dql':99C,115C,208C,225C,256C,337C,351C 'driver':5A,22B,33B,123C,133C 'e810':4A,26B,36B,291C 'e810-xxv':290C 'e830':381C 'earliest':382C 'elimin':310C 'environ':278C 'error':330C 'ethernet':288C 'execut':79B 'finish':218C 'first':384C 'follow':85C,246C,267C 'global':213C 'guarante':181C 'happen':244C 'hardwar':136C,167C 'hit':64B 'host':10A 'ice':21B,31B,90C,122C,342C,348C,356C,361C,379C 'ice-driv':20B 'infrastructur':23B 'intel':3A,25B,35B,286C 'intel-e810':24B 'intern':329C 'introduc':196C 'invalid':230C 'invok':126C 'irq':345C 'issu':322C 'kernel':2A,29B,71B,83C,309C,324C 'lib/dynamic_queue_limits.c':327C 'linux':1A,28B,82C 'linux-kernel':27B 'load':12A,282C 'lr':341C 'machin':300C 'manifest':264C 'mechan':391C 'memori':186C 'mmio':41B,93C,190C 'name':114C 'napi':357C,362C 'net':366C 'netdev':127C 'network':32B,281C 'nic':51B,111C,141C,157C,202C,217C 'normal':185C 'note':269C 'notif':390C 'num':116C,209C,254C,257C 'number':105C 'observ':223C,262C 'offload':385C 'oop':331C 'order':92C,154C,180C 'p':355C 'path':163C 'pc':336C 'poll':358C,363C 'potenti':198C 'previous':319C 'prior':375C 'process':144C 'provid':177C 'queu':108C,117C,210C,241C,255C 'queue':56B,130C,137C,147C,149C 'race':6A,199C 'rather':76B 'regist':191C 'relax':40B,171C,303C,396C 'reliabl':323C 'replac':301C 'reproduc':320C 'resolv':89C 'restor':91C,372C 'rev':295C 'rx':367C 'send':54B 'sent':129C 'servic':75B 'sfp':294C 'smp':335C 'start':53B 'state':101C,231C 'subsequ':131C 'support':386C 'sustain':280C 'tail':138C 'test':308C 'trace':272C,350C 'track':103C 'transmit':45B,113C,159C,162C,204C 'trigger':250C 'trim':275C 'tx':96C,128C,344C 'txtime':383C 'updat':119C,134C,151C,165C,211C,221C 'use':38B,169C,284C 'user':315C 'visibl':59B,214C 'vulner':86C 'work':146C 'workload':317C 'write':42B,94C,183C,188C 'writel':170C,193C,302C,305C,393C,395C 'x194/0x420':370C 'x1d4/0x620':347C 'x268/0x2a0':340C,354C 'x48/0x3f0':365C 'x94/0x520':360C 'xxv':292C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Linux kernel ice driver with an Intel E810 Ethernet controller, reported on arm64 machines under sustained network load. x86 systems and hosts without E810 hardware are not described as affected. Crash requires heavy Tx traffic to trigger the race.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98965","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98965","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98965","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}