CVE-2026-98967
Received
Received - Intake
Race Condition in Linux Kernel cxgb4/ch_ktls
Vulnerability report for CVE-2026-98967, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
cxgb4/ch_ktls: disable softirqs around tid_list erases
chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
using xa_insert_bh(). The array is shared by the adapter's connections
and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and
the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray
lock without disabling softirqs.
When cleanup runs with softirqs enabled, a receive softirq for another
connection on the same CPU can interrupt the erase and spin on the lock
held by the interrupted task. Use xa_erase_bh() at both sites to match
the insertion path.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 65e302a9bd57b62872040d57eea1201562a7cbb2 |
| Linux | Linux | 65e302a9bd57b62872040d57eea1201562a7cbb2 |
| Linux | Linux | 65e302a9bd57b62872040d57eea1201562a7cbb2 |
| Linux | Linux | 65e302a9bd57b62872040d57eea1201562a7cbb2 |
| Linux | Linux | 65e302a9bd57b62872040d57eea1201562a7cbb2 |
| Linux | Linux | b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78 |
| Linux | Linux | 70c4ead897211b184f36cbeda213f2a3e8153218 |
| Linux | Linux | 5.10.42 |
| Linux | Linux | 5.12.9 |
| Linux | Linux | 5.13 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
