Linux kernel CVE-2026-98965

Exploitation (a kernel panic/DoS) requires all of: an arm64 machine (the writel_relaxed() ordering weakness does not affect architectures where relaxed writes are already ordered relative to MMIO), the ice driver bound to an Intel E810/E830-class NIC, a kernel containing commit ccde82e90946 ('ice: add E830 Earliest TxTime First Offload support') - i.e. 6.18 and the affected stable backports before the fix - and sustained Tx network load sufficient to hit the race window between the DQL accounting write and the doorbell MMIO write. Limiting factors: there is no attacker-controlled crafted input; the condition is a timing race observed only under heavy load, it is architecture-specific to arm64, and it is confined to the ice driver code path, so non-arm64 systems and non-ice NICs are unaffected. Updating to a fixed kernel is the remedy stated in the sources.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) frames this as a network-reachable, low-complexity, unauthenticated availability issue, but that framing overstates attacker control. The description makes clear this is a CPU/MMIO memory-ordering race on arm64: the ice driver's Tx doorbell was changed to writel_relaxed() (by commit ccde82e90946), which on arm64 does not order the normal-memory DQL accounting write (dql->num_queued) before the MMIO doorbell write, so dql_completed() can observe more bytes completed than queued and hit BUG_ON at lib/dynamic_queue_limits.c:99, panicking the kernel. There is no crafted packet or attacker input that deterministically triggers this - it manifests under sustained legitimate network load, so AV:N/AC:L is a poor fit and the realistic complexity is high and platform-dependent. Supporting signals point to low real-world urgency: EPSS is 0.21% (10th percentile), the CVE is not in CISA KEV, and no exploit/PoC reference is present (the three git.kernel.org links are the fix commits, not exploit code). The vendor priority label is 'this_week' and a patch is available. Net: a genuine availability/stability regression worth patching on affected arm64 fleets, but not an actively exploited or weaponizable remote DoS; treat as a reliability fix rather than an emergency. Key caveat to verify: the CVSS network vector conflicts with the description's load-induced, non-attacker-controlled race - the A:H impact is real but the exploitability metrics are not.

An arm64 server using the Intel E810-XXV NIC with the ice driver runs under sustained network load; the relaxed doorbell write lets the NIC begin transmitting and complete descriptors before the DQL byte-accounting update becomes globally visible, so dql_completed() sees an impossible state and the BUG_ON panics the kernel, causing a denial of service. No attacker-crafted input is required - heavy legitimate traffic reproduces it reliably per the reporter. No public exploit identified at time of analysis.