CVE-2026-98317 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied:
# ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}'
# ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config"))
| .parms["interval-probe-time-ms"]'
0
Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is silently cast to u32, so a larger value can bypass the min check:
e.g. 4294967296 == 0x100000000
# ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}'
# ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config"))
| .parms["interval-probe-time-ms"]'
0
msecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is larger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR() when HZ > 1000 (Alpha, MIPS), and passing a negative integer to queue_delayed_work(unsigned long delay) causes sign extension, which wraps around the expiry time to the past, resulting in it being handled as 0 delay in the timer wheel.
Let's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.
The same max check is applied to sysctl as well.
Note that this controls the probe interval for NTF_MANAGED entries, so the max of 1 day is unlikely to break any deployments.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
This vulnerability involves a missing input validation in the Linux kernel's neighbor subsystem, specifically affecting the configuration of the NDTPA_INTERVAL_PROBE_TIME_MS parameter within network device tables. The core technical flaw stems from an incomplete attribute policy definition where the .validation_type field was omitted despite the presence of minimum and maximum value constraints. This omission allows user-space applications to bypass intended bounds checking when setting neighbor table parameters via netlink interfaces such as those exposed through ynl tools. Without proper validation logic, arbitrary values can be passed into kernel data structures without triggering range checks or type conversions that would normally sanitize input before processing.
The operational impact of this vulnerability is significant due to how the invalid value propagates through multiple layers of the kernel's time management subsystem. When a large unsigned 64-bit integer is provided as the probe interval, it undergoes silent truncation during conversion from milliseconds to jiffies via msecs_to_jiffies(). This function casts u64 values down to u32 without overflow detection, allowing extremely large numbers like 4294967296 (0x100000000) to wrap around and appear as zero. Furthermore, when HZ exceeds 1000 on architectures such as Alpha or MIPS, the multiplication involved in converting milliseconds to jiffies can cause integer overflow within NEIGH_VAR() macros. If a negative value results from sign extension during queue_delayed_work calls, it causes timer expiry times to wrap around into the past, effectively treating them as zero-delay timers that execute immediately rather than after their intended interval.
This behavior creates potential denial-of-service conditions by enabling attackers to manipulate neighbor table probe intervals in ways that disrupt normal network operation or cause excessive CPU usage through immediate re-execution of delayed work items. The vulnerability affects NTF_MANAGED entries which control how frequently the system probes for reachable neighbors, and while the patch limits maximum values to one day (86400 seconds), this still represents a substantial window during which improper timing could impact network stability or resource consumption patterns across affected systems running vulnerable kernel versions.
Mitigation requires applying patches that implement NLA_POLICY_FULL_RANGE() validation policies alongside explicit upper bound checks limiting interval-probe-time-ms to 86400 milliseconds per day. System administrators should ensure their kernels are updated with these fixes and monitor for unusual network behavior indicative of timer manipulation attempts. The fix also extends similar maximum value enforcement to sysctl interfaces, ensuring consistent protection across all configuration pathways. Organizations relying on precise neighbor discovery timing in high-availability environments should verify that deployed kernel versions include this correction since improper probe intervals can degrade ARP resolution performance or trigger unnecessary broadcast storms under certain conditions.
This issue aligns with CWE-20 Improper Input Validation and falls within ATT&CK technique T1496 Resource Hijacking through denial-of-service vectors involving timer manipulation. The lack of proper boundary checking represents a classic example of how missing validation logic can lead to unexpected behavior in system-level components that handle time-sensitive operations critical for network functionality.