CVE-2026-98618

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98618", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:38.631Z", "dateUpdated": "2026-10-19T09:22:46.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:46.174Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Handle maximum standalone channels\n\nStandalone channels use one NAPI vector for each Tx and Rx queue.\nfbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A\n64-Tx/64-Rx configuration therefore records 128 vectors but allocates\nonly 64, leaving NULL entries that resource setup dereferences.\n\nInclude the maximum vector count in standalone allocation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "versions": [{"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "9843e5fabd6ab296df9c025b1d0e5bf79a6b8a08", "status": "affected", "versionType": "git"}, {"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "6c903188b67617070017305a325fa326f270a43d", "status": "affected", "versionType": "git"}, {"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "16ff1023213cc39c1a7ce737205c2a1a53c3a716", "status": "affected", "versionType": "git"}, {"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "1f4c73064a50f53d596c6f1d06d2d700f43c4b32", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9843e5fabd6ab296df9c025b1d0e5bf79a6b8a08"}, {"url": "https://git.kernel.org/stable/c/6c903188b67617070017305a325fa326f270a43d"}, {"url": "https://git.kernel.org/stable/c/16ff1023213cc39c1a7ce737205c2a1a53c3a716"}, {"url": "https://git.kernel.org/stable/c/1f4c73064a50f53d596c6f1d06d2d700f43c4b32"}], "title": "eth: fbnic: Handle maximum standalone channels", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9843e5fabd6ab296df9c025b1d0e5bf79a6b8a08", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}, {"lessThan": "6c903188b67617070017305a325fa326f270a43d", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}, {"lessThan": "16ff1023213cc39c1a7ce737205c2a1a53c3a716", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}, {"lessThan": "1f4c73064a50f53d596c6f1d06d2d700f43c4b32", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Handle maximum standalone channels\n\nStandalone channels use one NAPI vector for each Tx and Rx queue.\nfbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A\n64-Tx/64-Rx configuration therefore records 128 vectors but allocates\nonly 64, leaving NULL entries that resource setup dereferences.\n\nInclude the maximum vector count in standalone allocation."}], "id": "CVE-2026-98618", "lastModified": "2026-10-19T10:19:25.863", "metrics": {}, "published": "2026-10-18T16:17:14.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/16ff1023213cc39c1a7ce737205c2a1a53c3a716"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f4c73064a50f53d596c6f1d06d2d700f43c4b32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c903188b67617070017305a325fa326f270a43d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9843e5fabd6ab296df9c025b1d0e5bf79a6b8a08"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eth: fbnic: Handle maximum standalone channels", "id": "2555008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555008"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\neth: fbnic: Handle maximum standalone channels\nStandalone channels use one NAPI vector for each Tx and Rx queue.\nfbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A\n64-Tx/64-Rx configuration therefore records 128 vectors but allocates\nonly 64, leaving NULL entries that resource setup dereferences.\nInclude the maximum vector count in standalone allocation.", "A flaw was found in the Linux kernel's fbnic network driver. When configuring the maximum number of standalone transmission and reception channels, the driver under-allocates vector resources, leaving uninitialized entries. This flaw allows a local user with administrative privileges to trigger a null pointer dereference during resource setup, resulting in a system crash and Denial of Service (DoS)."], "name": "CVE-2026-98618", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98618\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98618\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98618.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc6107771bb4be3009168cfda24d22131c026fe8,9843e5fabd6ab296df9c025b1d0e5bf79a6b8a08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc6107771bb4be3009168cfda24d22131c026fe8,6c903188b67617070017305a325fa326f270a43d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc6107771bb4be3009168cfda24d22131c026fe8,16ff1023213cc39c1a7ce737205c2a1a53c3a716)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc6107771bb4be3009168cfda24d22131c026fe8,1f4c73064a50f53d596c6f1d06d2d700f43c4b32)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:30:14.376034+00:00", "updated": "2026-10-22T23:30:13.572408+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}