CVE-2026-72409

Received Received - Intake

Kernel Interrupt Masking Flaw in Linux mvneta Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules NAPI poll, which calls enable_percpu_irq() on completion to unmask. If suspend occurs while NAPI poll is pending (between disable_percpu_irq in the ISR and enable_percpu_irq in poll completion), the interrupt is never re-enabled: 1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule() => MPIC masked, percpu_enabled cpumask bit cleared 2. NAPI poll does not complete before suspend proceeds (on PREEMPT_RT this is highly likely since softirqs run in ksoftirqd which gets frozen; on non-RT it can happen when softirq processing is deferred to ksoftirqd) 3. mvneta_stop_dev => napi_disable(): cancels the pending poll without executing the completion path 4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC (already masked, but records IRQS_SUSPENDED) 5. Resume: mpic_resume checks irq_percpu_is_enabled() => false (bit was cleared in step 1) => skips unmask 6. mvneta_start_dev only restores device-level INTR_NEW_MASK, does not touch the MPIC per-CPU mask Result: MPIC per-CPU interrupt stays masked permanently. The NIC generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never receives them, causing complete loss of network connectivity. Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt regardless of pre-suspend state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72409

EUVD

EUVD-2026-59308

Affected Vendors & Products

Vendor	Product	Version / Range
marvell	mvneta	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects Marvell mvneta network drivers on certain Arm platforms. It causes a permanent loss of network connectivity after system resume due to a masked per-CPU interrupt. The issue occurs when suspend happens while network processing is pending, preventing the interrupt from being re-enabled during resume.

Detection Guidance

This vulnerability may cause complete loss of network connectivity on Marvell MPIC platforms. Check for symptoms like persistent network failure after system resume or if interrupts are masked. Use commands like 'cat /proc/interrupts' to verify if per-CPU interrupts for mvneta are masked. If INTR_NEW_CAUSE shows activity but no interrupts are delivered, it may indicate this issue.

Impact Analysis

If you use a system with Marvell mvneta network hardware on affected Arm platforms, this vulnerability could cause complete network failure after suspend/resume cycles. The system would appear to have network connectivity but would not receive any network traffic.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level network interrupt handling issue in the Linux kernel. Compliance impacts would only occur if the resulting network connectivity loss disrupts data processing or transmission required by these regulations.

Mitigation Strategies

Apply the kernel patch that adds 'on_each_cpu(mvneta_percpu_enable)' in the resume path. Alternatively, avoid suspend/resume cycles on affected systems until patched. Monitor network connectivity after resuming to confirm the issue is resolved.

Hi! I’m here to help you understand CVE-2026-72409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70