CVE-2026-98547 Overview
CVE-2026-98547 is an integer overflow vulnerability in the Linux kernel's af_packet subsystem, specifically within the prb_calc_retire_blk_tmo() function. The flaw exists in 32-bit arithmetic that computes block retirement timeouts for TPACKET_V3 packet rings. A user-controlled tp_block_size value can trigger signed integer overflow, producing a negative timeout that programs an hrtimer to fire at the maximum rate. The result is a soft interrupt loop that holds sk_receive_queue.lock and consumes a CPU until the socket is closed. The overflow originated with the TPACKET_V3 implementation but became a reliable denial-of-service primitive after the switch to hrtimer in kernel v6.18.
Critical Impact
A local user with CAP_NET_RAW can wedge a CPU in softirq context and, with multiple rings, render the host unresponsive.
Affected Products
- Linux kernel versions containing TPACKET_V3 support with the hrtimer-based retire operation (introduced in v6.18)
- Earlier kernels contain the same overflow with reduced impact due to the prior unsigned short retire_blk_tov truncation
- Distributions shipping affected mainline/stable kernels
Discovery Timeline
- 2026-10-18 - CVE-2026-98547 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98547
Vulnerability Analysis
The defect is an [Integer Overflow] in prb_calc_retire_blk_tmo(), which calculates the retirement timeout for TPACKET_V3 ring blocks. The function computes mbits = (blk_size_in_bytes * 8) / (1024 * 1024) using 32-bit signed int arithmetic. Because packet_set_ring() only rejects tp_block_size values that are non-positive or not page-aligned, a 256 MiB block passes validation. Multiplying 0x10000000 by 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps (divisor of 1) the function returns -2047.
The trigger range is (8 * size) mod 2^32 >= 2^31 && div == 1, which covers block sizes of [256,512), [768,1024), [1280,1536) and [1792,2048) MiB. Faster links divide the unsigned value back below 2^31, which is why the condition does not fire on every system.
Root Cause
init_prb_bdqc() passes the negative result into ms_to_ktime() and then calls hrtimer_start() with HRTIMER_MODE_REL_SOFT. A negative relative timeout expires immediately. The timer callback returns HRTIMER_RESTART, and hrtimer_forward() clamps the negative interval to hrtimer_resolution. The soft timer then re-fires at maximum rate, holding sk_receive_queue.lock on every pass.
Attack Vector
An attacker opens an AF_PACKET socket, selects TPACKET_V3, and calls setsockopt(PACKET_RX_RING) with tp_block_size = 0x10000000. The exploit requires CAP_NET_RAW, which is granted by default inside --network host containers. A 1 Gbps NIC is sufficient to reach the overflow condition. Creating multiple such rings multiplies the CPU consumption and exhausts the host.
The vulnerability is described in prose because no verified exploit code is published beyond the reproducer in the upstream commit message. See the kernel commits linked below for the full patch and reproducer.
Detection Methods for CVE-2026-98547
Indicators of Compromise
- Sustained 100% CPU usage attributed to a ksoftirqd thread without a corresponding network workload
- Processes holding AF_PACKET sockets with PACKET_VERSION set to TPACKET_V3 and tp_block_size values at or above 0x10000000
- Unprivileged containers running with CAP_NET_RAW and host network namespace access
Detection Strategies
- Audit setsockopt calls on AF_PACKET sockets using eBPF or auditd and alert on tp_block_size values of 256 MiB or larger
- Correlate ksoftirqd CPU spikes with recent socket(AF_PACKET, ...) creation events from non-root workloads
- Review container runtime configurations for host networking combined with CAP_NET_RAW
Monitoring Recommendations
- Track per-CPU softirq time using /proc/softirqs and alert on sudden sustained increases
- Monitor kernel version inventory for hosts running v6.18 or later without the fix commits applied
- Log and review process capability sets for workloads that unexpectedly acquire CAP_NET_RAW
How to Mitigate CVE-2026-98547
Immediate Actions Required
- Apply the upstream patches referenced in the Linux stable commits (02afd75, 218a944, 297acc5, 56d8286, 6279211, b2bcc6a, be1aacf, eb5b383) once available in your distribution kernel
- Remove CAP_NET_RAW from workloads that do not require raw packet access
- Avoid running untrusted containers with --network host and raw socket capability
Patch Information
The fix converts the arithmetic in prb_calc_retire_blk_tmo() to 64-bit, preventing the signed overflow. Patches are available in the Linux stable tree. See the Linux Kernel Commit 02afd75 and the companion stable backports listed in the references for the full set of fix commits.
Workarounds
- Restrict AF_PACKET socket creation using seccomp filters on untrusted workloads
- Drop CAP_NET_RAW from container capability sets using --cap-drop=NET_RAW
- Enable kernel.unprivileged_userns_clone=0 where feasible to limit namespace-based capability acquisition
- Set user.max_user_namespaces=0 in environments that do not require unprivileged user namespaces
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
