CVE-2026-98547 - Vulnerability Details

- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

Description

In the Linux kernel, the following vulnerability has been resolved:

af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

prb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:

mbits = (blk_size_in_bytes * 8) / (1024 * 1024);

If I'm reading the validation right, tp_block_size is user
controlled and packet_set_ring() only rejects values that are <= 0
as int or not page aligned, so a 256MiB block goes right through
(and alloc_one_pg_vec_page() even has a vzalloc fallback for it).
0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps
(div == 1) the function ends up returning -2047.

The condition is actually (8 * size) mod 2^32 >= 2^31 && div == 1,
so the trigger set is [256,512), [768,1024), [1280,1536) and
[1792,2048) MiB. Other sizes wrap to non-negative values and faster
links divide the unsigned value back below 2^31, which is why this
doesn't blow up for everyone.

What makes it fatal is what happens next in init_prb_bdqc():

p1->interval_ktime = ms_to_ktime(prb_calc_retire_blk_tmo(...));
hrtimer_start(&p1->retire_blk_timer, p1->interval_ktime,
HRTIMER_MODE_REL_SOFT);

A negative relative timeout expires immediately. The callback
unconditionally returns HRTIMER_RESTART, and hrtimer_forward() turns
the negative interval into hrtimer_resolution:

if (interval < hrtimer_resolution)
interval = hrtimer_resolution;

So the SOFT timer re-fires at the maximum rate forever, holding
sk_receive_queue.lock each pass. One CPU spins in softirq until the
socket is closed. Repeat with more rings and the machine is gone.

The overflow itself is ancient - it was introduced together with
TPACKET_V3 in f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer
implementation."). Its effect prior to f7460d2989fa ("net:
af_packet: Use hrtimer to do the retire operation", v6.18) was not
as clear-cut, though: the return value was stored into an unsigned
short retire_blk_tov, so a negative result was truncated, and a
0-jiffy delay loop could be programmed as well. Neither is nearly
as detrimental as the immediate maximum-rate spin the hrtimer
conversion turned it into.

(Unrelated to CVE-2019-20812 - that one was the ethtool failure path
returning 0, which now returns DEFAULT_PRB_RETIRE_TOV.)

Reproducer, needs CAP_NET_RAW (a --network host container has it by
default) and a 1 Gbps NIC (QEMU e1000 works):

int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
bind(fd, ...);
int v = TPACKET_V3;
setsockopt(fd, SOL_PACKET, PACKET_VERSION, &v, sizeof(v));
struct tpacket_req3 req = {
.tp_block_size = 0x10000000,
.tp_block_nr = 1,
.tp_frame_size = 2048,
.tp_frame_nr = 0x10000000 / 2048,
.tp_retire_blk_tov = 0,
};
setsockopt(fd, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));

Compute in 64 bits instead. The operands are already bounded by the
existing validation, so nothing else changes. If you'd prefer a
different fix, just say so and I'll respin.

Published: 2026-10-18

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an integer overflow in the af_packet network interface function prb_calc_retire_blk_tmo(). User-controlled block sizes that exceed 256 MiB cause the 32-bit calculation to wrap to a negative value. The function then sets a high‑resolution timer with a negative relative timeout, which the kernel interprets as an immediate expiration. This causes the timer callback to fire continuously at the maximum rate, holding a critical lock for the remainder of the socket’s lifetime and spinning the CPU indefinitely. The result is a denial of service that can consume a core or all CPUs, effectively freezing the host.

Affected Systems

The issue occurs in the Linux kernel for any release that contains the af_packet TPACKET_V3 implementation and omits the overflow fix. All vendors shipping the upstream kernel—including stock Linux distributions—are affected until the patch is applied. The affected component is the kernel’s packet‑ring driver; specific version ranges are not enumerated in the advisory but include any kernel prior to the commit that added the 64‑bit calculation path.

Risk and Exploitability

No EPSS score is available and the vulnerability is not listed in CISA KEV, but the required conditions—CAP_NET_RAW privilege, an AF_PACKET raw socket, and a 1 Gbps NIC—make the risk high for privileged local actors. An attacker with the ability to open raw sockets can set a tp_block_size in the trigger range [256,512), [768,1024), [1280,1536) or [1792,2048) MiB and cause the kernel timer to erupt. The local privilege requirement limits exploitation to users with elevated rights, yet once triggered the denial of service affects the whole system. The CVSS score is not specified in the advisory, yet the described impact warrants a high severity assessment.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< 02afd75649a4e001031ed82153a5c39312ec0737
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< eb5b3838b9200dac04bfe33483db0ee8287456fb
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< 297acc571d5813db76b147c745b91031d5f9c960
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< be1aacff399d519cc48d6b34354a54dd79041140
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< b2bcc6a254d6f27823a56787668ae4ee8cdb6e71
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< 6279211e7d2456ecd195d236c9ee5e5c6fa5a17a
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< 218a944b9e035d4b47d59c69af6ca13319da15fb
`f6fb8f100b807378fda19e83e5ac6828b638603a`	affected	< 56d82862a0a243ac14ba11b6d7b57ddc2d064b95

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3-rc5`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the af_packet integer‐overflow fix (commit f7460d2989fa).
If an upgrade is not possible, rebuild the kernel without TPACKET_V3 support or configure packet_set_ring to disallow block sizes larger than 256 MiB.
Restrict processes that can open raw AF_PACKET sockets by limiting CAP_NET_RAW privileges or enforcing SELinux/AppArmor policies.

Generated by OpenCVE AI on October 18, 2026 at 18:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02afd75649a4e001031ed82153a5c39312ec0737
https://git.kernel.org/stable/c/218a944b9e035d4b47d59c69af6ca13319da15fb
https://git.kernel.org/stable/c/297acc571d5813db76b147c745b91031d5f9c960
https://git.kernel.org/stable/c/56d82862a0a243ac14ba11b6d7b57ddc2d064b95
https://git.kernel.org/stable/c/6279211e7d2456ecd195d236c9ee5e5c6fa5a17a
https://git.kernel.org/stable/c/b2bcc6a254d6f27823a56787668ae4ee8cdb6e71
https://git.kernel.org/stable/c/be1aacff399d519cc48d6b34354a54dd79041140
https://git.kernel.org/stable/c/eb5b3838b9200dac04bfe33483db0ee8287456fb

History

Sun, 18 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-680

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: af_packet: fix integer overflow in prb_calc_retire_blk_tmo() prb_calc_retire_blk_tmo() computes in 32-bit int arithmetic: mbits = (blk_size_in_bytes * 8) / (1024 * 1024); If I'm reading the validation right, tp_block_size is user controlled and packet_set_ring() only rejects values that are <= 0 as int or not page aligned, so a 256MiB block goes right through (and alloc_one_pg_vec_page() even has a vzalloc fallback for it). 0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps (div == 1) the function ends up returning -2047. The condition is actually (8 * size) mod 2^32 >= 2^31 && div == 1, so the trigger set is [256,512), [768,1024), [1280,1536) and [1792,2048) MiB. Other sizes wrap to non-negative values and faster links divide the unsigned value back below 2^31, which is why this doesn't blow up for everyone. What makes it fatal is what happens next in init_prb_bdqc(): p1->interval_ktime = ms_to_ktime(prb_calc_retire_blk_tmo(...)); hrtimer_start(&p1->retire_blk_timer, p1->interval_ktime, HRTIMER_MODE_REL_SOFT); A negative relative timeout expires immediately. The callback unconditionally returns HRTIMER_RESTART, and hrtimer_forward() turns the negative interval into hrtimer_resolution: if (interval < hrtimer_resolution) interval = hrtimer_resolution; So the SOFT timer re-fires at the maximum rate forever, holding sk_receive_queue.lock each pass. One CPU spins in softirq until the socket is closed. Repeat with more rings and the machine is gone. The overflow itself is ancient - it was introduced together with TPACKET_V3 in f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation."). Its effect prior to f7460d2989fa ("net: af_packet: Use hrtimer to do the retire operation", v6.18) was not as clear-cut, though: the return value was stored into an unsigned short retire_blk_tov, so a negative result was truncated, and a 0-jiffy delay loop could be programmed as well. Neither is nearly as detrimental as the immediate maximum-rate spin the hrtimer conversion turned it into. (Unrelated to CVE-2019-20812 - that one was the ethtool failure path returning 0, which now returns DEFAULT_PRB_RETIRE_TOV.) Reproducer, needs CAP_NET_RAW (a --network host container has it by default) and a 1 Gbps NIC (QEMU e1000 works): int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); bind(fd, ...); int v = TPACKET_V3; setsockopt(fd, SOL_PACKET, PACKET_VERSION, &v, sizeof(v)); struct tpacket_req3 req = { .tp_block_size = 0x10000000, .tp_block_nr = 1, .tp_frame_size = 2048, .tp_frame_nr = 0x10000000 / 2048, .tp_retire_blk_tov = 0, }; setsockopt(fd, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req)); Compute in 64 bits instead. The operands are already bounded by the existing validation, so nothing else changes. If you'd prefer a different fix, just say so and I'll respin.
Title		af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02afd75649a4e001031ed82153a5c39312ec0737 https://git.kernel.org/stable/c/218a944b9e035d4b47d59c69af6ca13319da15fb https://git.kernel.org/stable/c/297acc571d5813db76b147c745b91031d5f9c960 https://git.kernel.org/stable/c/56d82862a0a243ac14ba11b6d7b57ddc2d064b95 https://git.kernel.org/stable/c/6279211e7d2456ecd195d236c9ee5e5c6fa5a17a https://git.kernel.org/stable/c/b2bcc6a254d6f27823a56787668ae4ee8cdb6e71 https://git.kernel.org/stable/c/be1aacff399d519cc48d6b34354a54dd79041140 https://git.kernel.org/stable/c/eb5b3838b9200dac04bfe33483db0ee8287456fb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:15.669Z

Updated: 2026-10-18T15:18:15.669Z

Reserved: 2026-09-25T10:25:14.356Z

Link: CVE-2026-98547

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:06.630

Modified: 2026-10-18T16:17:06.630

Link: CVE-2026-98547

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-18T18:15:15Z

Weaknesses

CWE-680
Integer Overflow to Buffer Overflow

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object