CVE-2026-98489: net: atl1c: fix soft lockup on out-of-range tpd_cons read

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: atl1c: fix soft lockup on out-of-range tpdcons read

The hardware can report an out-of-range tpdcons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead.

Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to:

- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap precursor, before the lockup was captured with a full trace elsewhere:

atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>

65535 (0xffff) here is the same value tpdcons reads back once the loop below gets stuck.

- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time caught by the soft lockup watchdog with a full stack trace:

watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329] CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy) RIP: 0010:atl1ccleantx+0x142/0x2d0 [atl1c] Call Trace: <TASK> napipoll+0x32/0x1e0 napithreadedpollloop+0x286/0x2e0 napithreadedpoll+0xfd/0x140 kthread+0xf7/0x130 retfromfork+0x2da/0x3a0 retfromforkasm+0x1a/0x30 </TASK>

Affected Software

1 affected component

Linux Linux kernel=7.0.0-31-generic, =7.0.14-11-pve

Event History

Oct 18, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Which systems are known to be affected?

The issue was reproduced on systems using a Qualcomm Atheros AR8151 v2.0 NIC in a four-port configuration. The reported environments were Ubuntu 26.04.1 LTS with kernel 7.0.0-31-generic and Proxmox VE with kernel 7.0.14-11-pve.

What condition triggers the lockup?

The lockup occurs when the NIC hardware reports an invalid transmit-descriptor consumer value of 0xffff while the PCIe link or MAC is resetting. In the reported reproductions, rebooting a directly connected Mikrotik CCR2004 PCIe card caused the relevant link flap and reset condition.

How can I identify this issue in logs?

Indicators include a NETDEV WATCHDOG transmit-queue timeout, messages that the MAC state machine cannot become idle, and a link-up message reporting 65535 Mbps. A soft-lockup watchdog report with a napi-related task stuck for an extended period is also consistent with the reported failure.

What can be done if the fix cannot be deployed immediately?

Avoid rebooting or otherwise causing link-reset events on directly connected equipment where feasible, since this was the reported trigger. The fix changes handling of the invalid 0xffff value so it is treated as no new descriptors to clean rather than entering the non-terminating cleanup loop.

CVE-2026-98489: net: atl1c: fix soft lockup on out-of-range tpd_cons read

Affected Software

Event History

Frequently Asked Questions

Which systems are known to be affected?

What condition triggers the lockup?

How can I identify this issue in logs?

What can be done if the fix cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are known to be affected?

What condition triggers the lockup?

How can I identify this issue in logs?

What can be done if the fix cannot be deployed immediately?