{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98850", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.376Z", "datePublished": "2026-10-18T15:50:50.062Z", "dateUpdated": "2026-10-30T12:40:11.960Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:11.960Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\n\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\n\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "1e6ee93cea4b77253b1b81eb5759899f959ebee3", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "70fefff0801d4c5405e515592d1e7ad1351530cd", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "4848c175b5984e6358bcca794ac1dee4d527efcc", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "ae169d318d5d23bac76ece90a7e2b5cb760ed043", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "be12b221c0301111eeb023be04add3c6ad7c21fe", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "69ca64bbb528898916f309552053c32a04a36ebc", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "9fd63d284e251332f4874ef9023cde472f315f86", "status": "affected", "versionType": "git"}, {"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "lessThan": "2cf81fc9505b148b1b70068303ea6ea4b1212403", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1e6ee93cea4b77253b1b81eb5759899f959ebee3"}, {"url": "https://git.kernel.org/stable/c/70fefff0801d4c5405e515592d1e7ad1351530cd"}, {"url": "https://git.kernel.org/stable/c/4848c175b5984e6358bcca794ac1dee4d527efcc"}, {"url": "https://git.kernel.org/stable/c/ae169d318d5d23bac76ece90a7e2b5cb760ed043"}, {"url": "https://git.kernel.org/stable/c/be12b221c0301111eeb023be04add3c6ad7c21fe"}, {"url": "https://git.kernel.org/stable/c/69ca64bbb528898916f309552053c32a04a36ebc"}, {"url": "https://git.kernel.org/stable/c/9fd63d284e251332f4874ef9023cde472f315f86"}, {"url": "https://git.kernel.org/stable/c/2cf81fc9505b148b1b70068303ea6ea4b1212403"}], "title": "net/packet: prevent TX_RING byte count overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1e6ee93cea4b77253b1b81eb5759899f959ebee3", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "70fefff0801d4c5405e515592d1e7ad1351530cd", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "4848c175b5984e6358bcca794ac1dee4d527efcc", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "ae169d318d5d23bac76ece90a7e2b5cb760ed043", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "be12b221c0301111eeb023be04add3c6ad7c21fe", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "69ca64bbb528898916f309552053c32a04a36ebc", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "9fd63d284e251332f4874ef9023cde472f315f86", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}, {"lessThan": "2cf81fc9505b148b1b70068303ea6ea4b1212403", "status": "affected", "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\n\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\n\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops."}], "id": "CVE-2026-98850", "lastModified": "2026-10-30T13:21:30.597", "metrics": {}, "published": "2026-10-18T16:17:39.390", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e6ee93cea4b77253b1b81eb5759899f959ebee3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2cf81fc9505b148b1b70068303ea6ea4b1212403"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4848c175b5984e6358bcca794ac1dee4d527efcc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69ca64bbb528898916f309552053c32a04a36ebc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70fefff0801d4c5405e515592d1e7ad1351530cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9fd63d284e251332f4874ef9023cde472f315f86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae169d318d5d23bac76ece90a7e2b5cb760ed043"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be12b221c0301111eeb023be04add3c6ad7c21fe"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/packet: prevent TX_RING byte count overflow", "id": "2555213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555213"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/packet: prevent TX_RING byte count overflow\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops.", "A flaw was found in the Linux kernel's packet socket implementation. An integer overflow occurs in the transmission ring buffer when calculating the total byte count of transmitted frames during a send operation. A local user with raw network privileges can exploit this issue to trigger an internal kernel error, leading to a system crash and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98850", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98850\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98850\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98850.mbox"], "threat_severity": "Moderate"}