CVE-2026-98317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98317", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.339Z", "datePublished": "2026-10-06T08:46:12.351Z", "dateUpdated": "2026-10-19T09:17:27.952Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:27.952Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n\n # ynl --family rt-neigh --do setneightbl \\\n --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}'\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]'\n 0\n\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\n\n e.g. 4294967296 == 0x100000000\n\n # ynl --family rt-neigh --do setneightbl \\\n --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}'\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]'\n 0\n\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ > 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\n\nLet's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\n\nThe same max check is applied to sysctl as well.\n\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/rt-neigh.yaml", "Documentation/networking/ip-sysctl.rst", "net/core/neighbour.c"], "versions": [{"version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "lessThan": "982c7f66c04134b77126edbfd8a63ecd6928cfd9", "status": "affected", "versionType": "git"}, {"version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "lessThan": "8550b50e49b01b572e653e572f24ddd73949aa74", "status": "affected", "versionType": "git"}, {"version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "lessThan": "6d79b223ec44ada58ad37db42f539b60985a7722", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/rt-neigh.yaml", "Documentation/networking/ip-sysctl.rst", "net/core/neighbour.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/982c7f66c04134b77126edbfd8a63ecd6928cfd9"}, {"url": "https://git.kernel.org/stable/c/8550b50e49b01b572e653e572f24ddd73949aa74"}, {"url": "https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}], "title": "neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/rt-neigh.yaml", "Documentation/networking/ip-sysctl.rst", "net/core/neighbour.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "982c7f66c04134b77126edbfd8a63ecd6928cfd9", "status": "affected", "version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "versionType": "git"}, {"lessThan": "8550b50e49b01b572e653e572f24ddd73949aa74", "status": "affected", "version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "versionType": "git"}, {"lessThan": "6d79b223ec44ada58ad37db42f539b60985a7722", "status": "affected", "version": "211da42eaa45db7b0edfde187dd88a85fbd466b5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/rt-neigh.yaml", "Documentation/networking/ip-sysctl.rst", "net/core/neighbour.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n\n # ynl --family rt-neigh --do setneightbl \\\n --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}'\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]'\n 0\n\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\n\n e.g. 4294967296 == 0x100000000\n\n # ynl --family rt-neigh --do setneightbl \\\n --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}'\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]'\n 0\n\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ > 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\n\nLet's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\n\nThe same max check is applied to sysctl as well.\n\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments."}], "id": "CVE-2026-98317", "lastModified": "2026-10-19T10:18:33.840", "metrics": {}, "published": "2026-10-06T09:18:23.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8550b50e49b01b572e653e572f24ddd73949aa74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/982c7f66c04134b77126edbfd8a63ecd6928cfd9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS", "id": "2546517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546517"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nneighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n# ynl --family rt-neigh --do setneightbl \\\n--json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}'\n# ynl --family rt-neigh --dump getneightbl --output-json | \\\njq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n| .parms[\"interval-probe-time-ms\"]'\n0\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\ne.g. 4294967296 == 0x100000000\n# ynl --family rt-neigh --do setneightbl \\\n--json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}'\n# ynl --family rt-neigh --dump getneightbl --output-json | \\\njq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n| .parms[\"interval-probe-time-ms\"]'\n0\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ > 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\nLet's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\nThe same max check is applied to sysctl as well.\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments.", "A flaw was found in the Linux kernel. A local user with network configuration privileges can cause a Denial of Service (DoS) by supplying out-of-range neighbor probe interval values via Netlink or sysctl. Because the kernel fails to properly validate these boundary values, an integer overflow occurs during timer calculations, causing delayed work queues to trigger immediately and leading to excessive system resource consumption."], "name": "CVE-2026-98317", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98317\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98317\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98317.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[211da42eaa45db7b0edfde187dd88a85fbd466b5,982c7f66c04134b77126edbfd8a63ecd6928cfd9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[211da42eaa45db7b0edfde187dd88a85fbd466b5,8550b50e49b01b572e653e572f24ddd73949aa74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[211da42eaa45db7b0edfde187dd88a85fbd466b5,6d79b223ec44ada58ad37db42f539b60985a7722)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.54,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:45:18.456050+00:00", "updated": "2026-10-11T03:45:17.610730+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}