CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved:

net/packet: prevent TX RING byte count overflow

tpacket snd() drains every SEND REQUEST frame in a TX ring and adds each valid packet length to the signed int len sum. Userspace can recycle completed frames concurrently, so a single blocking send call is not bounded by the ring size.

After enough successful transmissions len sum wraps into the negative range. In particular, 65536 65535-byte frames followed by a 65007-byte frame produce 0xfffffdef, or -EIOCBQUEUED. sock sendmsg nosec() treats that as an impossible return and triggers a BUG. On systems configured to panic on oops, a CAP NET RAW holder can panic the host kernel.

Stop before the next frame would make the byte count exceed INT MAX. The positive short count leaves that frame pending for a later send call.

A two-thread TPACKET V2 reproducer triggered the BUG on an arm64 build of Linux 7.3-rc4. With this change, the same reproducer returned the expected positive short count without an oops.