CVE-2026-98488
Description
A flaw was found in the Linux kernel's Atheros L1E Gigabit Ethernet (atl1e) network driver. While the network interface hardware is resetting, it can report an unexpected out-of-range status value during transmit packet processing. Because the driver does not properly validate this value, it enters an infinite loop waiting for an unreachable condition, resulting in a soft lockup. This failure causes a Denial of Service (DoS), making the affected system unresponsive.
Statement
This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access, high privileges or control over hardware states, and is constrained to systems equipped with specific Atheros L1E network hardware during link or MAC reset events. Typical enterprise server deployments rarely utilize this consumer-grade Ethernet controller, significantly limiting the real-world attack surface across Red Hat environments. In environments where this hardware is present, triggering the flaw leads solely to a denial of service via a kernel soft lockup, without compromising confidentiality or system integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.1 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
