CVE-2026-98233: net/packet: clear RX owner on VNET header error

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed. With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet. Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

Affected products

Linux kernel: from 4.14.175 before 4.15; from 4.19.114 before 4.20; from 5.4.29 before 5.5; from 5.5.14 before 5.6; 5.6 — fixed in 4.15, 4.20, 5.5, 5.6, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 4.15, 4.20, 5.5, 5.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98233 or the next vulnerability affects your stack