CVE-2026-98105

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: oa_tc6: Improve the error recovery

When oversubscribed traffic causes lot of buffer overflow errors,

probably due to loss of data chunks, driver fails to find a

data chunk with end_valid bit set, before it runs out of sk buffer

space. As a result, assert is seen during skb_put.

Now, check is made if skb buffer has enough tailroom for the

incoming data before accepting. If there is no room, current

frame is abandoned and it will start looking for a data chunk

with start_valid bit, that is a new frame.

SK buffer allocation error is considered as recoverable error.

rx_buf_overflow flag is too specific and no longer the only

condition this flag is used for. Therefore it is renamed as

wait_until_start_valid. This is more appropriate as this flag

is used to look for the next data chunk with SV bit set, after

failures like buffer overflow, buffer allocation failure, skb pointer

validity besides buffer over

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References