CVE-2026-98850

net/packet: prevent TX_RING byte count overflow

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: prevent TX_RING byte count overflow

tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum. Userspace can recycle completed frames concurrently, so a single blocking send call is not bounded by the ring size.

After enough successful transmissions len_sum wraps into the negative range. In particular, 65536 65535-byte frames followed by a 65007-byte frame produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats that as an impossible return and triggers a BUG. On systems configured to panic on oops, a CAP_NET_RAW holder can panic the host kernel.

Stop before the next frame would make the byte count exceed INT_MAX. The positive short count leaves that frame pending for a later send call.

A two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build of Linux 7.3-rc4. With this change, the same reproducer returned the expected positive short count without an oops.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 1e6ee93cea4b77253b1b81eb5759899f959ebee3Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 70fefff0801d4c5405e515592d1e7ad1351530cdAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 4848c175b5984e6358bcca794ac1dee4d527efccAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before ae169d318d5d23bac76ece90a7e2b5cb760ed043Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before be12b221c0301111eeb023be04add3c6ad7c21feAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 69ca64bbb528898916f309552053c32a04a36ebcAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 9fd63d284e251332f4874ef9023cde472f315f86Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 2cf81fc9505b148b1b70068303ea6ea4b1212403Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 1e6ee93cea4b77253b1b81eb5759899f959ebee3Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 70fefff0801d4c5405e515592d1e7ad1351530cdAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 4848c175b5984e6358bcca794ac1dee4d527efccAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before ae169d318d5d23bac76ece90a7e2b5cb760ed043Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before be12b221c0301111eeb023be04add3c6ad7c21feAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 69ca64bbb528898916f309552053c32a04a36ebcAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 9fd63d284e251332f4874ef9023cde472f315f86Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 2cf81fc9505b148b1b70068303ea6ea4b1212403Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.