CVE-2026-98233

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error

Commit 61fad6816fc1 (“net/packet: tpacket_rcv: avoid a producer race condition”) added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed.

With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet.

Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

Affected product:

AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

kernel @ 5.10.0 (+4 more)

Live-patch status from KernelCare for each operating system.