CVE Tools
Track your stack

CVE-2026-98275

net: ethernet: cortina: Ack RX overrun interrupt correctly

No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.

CVSS —Not scoredEPSS percentile7th0.2% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, < 1163cc82dcbc145f912bf2106ab668762f53e483Upgrade to: 1163cc82dcbc145f912bf2106ab668762f53e483Affected: ≥ 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, < 12a0c7bb448c1899ea3d8f97fa47a8740044e16dUpgrade to: 12a0c7bb448c1899ea3d8f97fa47a8740044e16dAffected: ≥ 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, < d72d87926ca33c6766dc73ace46859d7220a45bbUpgrade to: d72d87926ca33c6766dc73ace46859d7220a45bbAffected: ≥ 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, < 472493d1d3334d104b9873abc1c2d80ed3b144f3Upgrade to: 472493d1d3334d104b9873abc1c2d80ed3b144f3 + 4 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmac_irq() acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1 the shift leaves no bit in the 32-bit register. Acknowledge the same per-port RX overrun bit that was detected.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS7th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

2 events over 0 days, from the signal feeds we watch.

  1. Publishedrecord updated

Affected products

Sources

References in the record

And 5 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.