CVE-2026-98494: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved:
net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read
Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read"): the hardware can report an out-of-range cmbtpdnexttoclean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the atl1 network driver are exposed when the affected hardware reports an invalid transmit-cleanup index during a PCIe link or MAC reset.
What condition triggers the lockup?
The condition occurs when hardware reports an out-of-range cmb_tpd_next_to_clean value, observed as 0xffff, while the PCIe link or MAC is resetting. The driver’s cleanup loop cannot reach that value and can spin indefinitely, causing a soft lockup.
Does exploitation require network access or attacker-controlled input?
The provided information identifies a hardware/driver state during PCIe link or MAC reset as the trigger. It does not state that network access, authentication, or attacker-controlled traffic is required.
What does the fix do?
The fix treats an out-of-range cmb_tpd_next_to_clean value as indicating that there is nothing new to clean, preventing the transmit-cleanup loop from spinning forever.