CVE-2026-98233

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98233", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.328Z", "datePublished": "2026-10-06T08:45:06.533Z", "dateUpdated": "2026-10-19T09:16:05.070Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:16:05.070Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header. If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path. TPACKET_V3 already clears\nits block state here."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "bb10a0084c03a94364aeec542beddc5d49b59f59", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "b8c0cb3069058c2d67b5c7c833b2833381ecffdc", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "2daa618e7ff19eefcbda281bc4c5998c4140f9cf", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "23cd30498891d29a69ec9b75bd92f8a0f21f1342", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "49a48a5aaf85fe69d2dc3fb334b4854fadf44e39", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "805edbdcb8681da5f7ee43b3c3c809f7a8c31208", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "693209a237fc548791cf402441db8b68d1da7d38", "status": "affected", "versionType": "git"}, {"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "lessThan": "33ff111d7ba3beb86e28938d6382bb5beabd865a", "status": "affected", "versionType": "git"}, {"version": "2975472e042e0bbfeeabddc5023cb8c011ec5a07", "status": "affected", "versionType": "git"}, {"version": "6fb0e4385928900ccb8697748555b3f54bba5193", "status": "affected", "versionType": "git"}, {"version": "86137342fd4cf52882842aa8d1318b2661f08e8a", "status": "affected", "versionType": "git"}, {"version": "b06e4d3ed4044c2facf10a511d809f9aa29d960e", "status": "affected", "versionType": "git"}, {"version": "4.14.175", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.114", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.29", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.5.14", "lessThan": "5.6", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59"}, {"url": "https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc"}, {"url": "https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf"}, {"url": "https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342"}, {"url": "https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39"}, {"url": "https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208"}, {"url": "https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38"}, {"url": "https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a"}], "title": "net/packet: clear RX owner on VNET header error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb10a0084c03a94364aeec542beddc5d49b59f59", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "b8c0cb3069058c2d67b5c7c833b2833381ecffdc", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "2daa618e7ff19eefcbda281bc4c5998c4140f9cf", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "23cd30498891d29a69ec9b75bd92f8a0f21f1342", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "49a48a5aaf85fe69d2dc3fb334b4854fadf44e39", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "805edbdcb8681da5f7ee43b3c3c809f7a8c31208", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "693209a237fc548791cf402441db8b68d1da7d38", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"lessThan": "33ff111d7ba3beb86e28938d6382bb5beabd865a", "status": "affected", "version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2", "versionType": "git"}, {"status": "affected", "version": "2975472e042e0bbfeeabddc5023cb8c011ec5a07", "versionType": "git"}, {"status": "affected", "version": "6fb0e4385928900ccb8697748555b3f54bba5193", "versionType": "git"}, {"status": "affected", "version": "86137342fd4cf52882842aa8d1318b2661f08e8a", "versionType": "git"}, {"status": "affected", "version": "b06e4d3ed4044c2facf10a511d809f9aa29d960e", "versionType": "git"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.175", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.114", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.29", "versionType": "semver"}, {"lessThan": "5.6", "status": "affected", "version": "5.5.14", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header. If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path. TPACKET_V3 already clears\nits block state here."}], "id": "CVE-2026-98233", "lastModified": "2026-10-19T10:18:24.100", "metrics": {}, "published": "2026-10-06T09:18:10.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/packet: clear RX owner on VNET header error", "id": "2546391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546391"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/packet: clear RX owner on VNET header error\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header. If the conversion\nfails, the drop path leaves the slot claimed.\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\nClear the ownership bit on this error path. TPACKET_V3 already clears\nits block state here.", "A flaw was found in the Linux kernel's packet socket implementation. An attacker could cause a Denial of Service (DoS) by transmitting network packets that fail virtual network header processing. When processing encounters an error, the kernel fails to clear the ownership status of the assigned receive ring buffer slot. This leaves buffer slots permanently unavailable, preventing legitimate packets from being received and leading to dropped network traffic."], "name": "CVE-2026-98233", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98233\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98233\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98233.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,bb10a0084c03a94364aeec542beddc5d49b59f59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,b8c0cb3069058c2d67b5c7c833b2833381ecffdc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,2daa618e7ff19eefcbda281bc4c5998c4140f9cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,23cd30498891d29a69ec9b75bd92f8a0f21f1342)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,49a48a5aaf85fe69d2dc3fb334b4854fadf44e39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,805edbdcb8681da5f7ee43b3c3c809f7a8c31208)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,693209a237fc548791cf402441db8b68d1da7d38)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,33ff111d7ba3beb86e28938d6382bb5beabd865a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2975472e042e0bbfeeabddc5023cb8c011ec5a07"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "6fb0e4385928900ccb8697748555b3f54bba5193"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "86137342fd4cf52882842aa8d1318b2661f08e8a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b06e4d3ed4044c2facf10a511d809f9aa29d960e"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.175,4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.114,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.29,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.14,5.6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T12:00:15.383061+00:00", "updated": "2026-10-10T01:45:15.414605+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-772"]}