CVE-2026-98277

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnic_tx_map() skips the doorbell write, and the completion request, for every packet handed to it with xmit_more set, counting on the packet which ends the burst to publish them all. When that packet is dropped instead - skb_put_padto(), skb_cow_head() or a DMA mapping failure - nothing rings. The descriptors of the preceding packets stay invisible to the HW until the next transmit on that queue, which for a burst-then-idle workload may never come. Remember the meta descriptor of the last packet left without a doorbell and flush it from the error paths. The completion request has to be set on that descriptor rather than simply writing the tail, otherwise the HW would transmit the packets but never report a head, and the ring would fill up and stall for good. This is very similar to Joe's recent series of fixes for bnxt. Not seen in real life, reproduced under QEMU with failure injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98277

EUVD

EUVD-2026-93205

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9a57bacd574b52b08bc2c600af6a8c7a87049ecf
Linux	Linux	9a57bacd574b52b08bc2c600af6a8c7a87049ecf
Linux	Linux	9a57bacd574b52b08bc2c600af6a8c7a87049ecf
Linux	Linux	6.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the fbnic network driver. It occurs when packets are transmitted in a burst with the xmit_more flag set. The driver assumes the last packet in the burst will ring the doorbell to notify hardware of pending descriptors. If the last packet is dropped due to errors like skb_put_padto(), skb_cow_head(), or DMA mapping failure, the doorbell is never rung. This leaves preceding packets stuck in the queue, invisible to hardware until the next transmit, which may never occur.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbnic driver and may not have direct detection commands. Monitor kernel logs for tx_map errors or descriptor stalls in the fbnic driver. Check for unusual network transmission delays or packet drops on affected systems.

Impact Analysis

This vulnerability could cause network performance issues or packet loss. If packets are dropped unexpectedly, the network stack may stall, leading to delays or failures in transmitting data. Systems relying on the fbnic driver for network operations could experience degraded performance or connectivity problems.

Compliance Impact

This vulnerability affects network packet transmission in the Linux kernel's fbnic driver, potentially leading to data loss or incomplete transmission. While it does not directly impact compliance with standards like GDPR or HIPAA, such issues could indirectly affect data integrity and availability requirements under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Monitor network traffic for unusual drops or stalls in the fbnic driver. Ensure DMA mapping failures and skb_put_padto() errors are handled properly to prevent descriptor stalls.

Hi! I’m here to help you understand CVE-2026-98277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70