CVE-2026-98317

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses

.validation_type, so no validation is applied:

# ynl --family rt-neigh --do setneightbl \

--json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}'

# ynl --family rt-neigh --dump getneightbl --output-json | \

jq '.[] | select(.name == "arp_cache" and has("config"))

| .parms["interval-probe-time-ms"]'

0

Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is

silently cast to u32, so a larger value can bypass the min check:

e.g. 4294967296 == 0x100000000

# ynl --family rt-neigh --do setneightbl \

--json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}'

# ynl --family rt-neigh --dump getneightbl --output-json | \

jq '.[] | select(.name == "arp_cache" and has("config"))

| .parms["interval-probe-time-ms"]'

0

msecs_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References