CVE-2026-97434

Received Received - Intake

NAPI Handling Fix in Linux Kernel dpaa2-switch

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. The NAPI instances get disabled only once the last port goes down. This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled. In order to avoid this, split up the unregister_netdev() calls from the free_netdev() so that we make sure all ports go down before we attempt a deletion of NAPI instances. Also, make the netif_napi_del() explicit as it is on the .probe() path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97434

EUVD

EUVD-2026-86047

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's dpaa2-switch driver. It involves improper handling of NAPI (New API) instances during device removal. NAPI instances are shared across all ports of a DPSW device but are attached to the first port's net_device. When ports are unregistered one by one during removal, NAPI instances may be deleted prematurely before they are properly disabled, leading to potential system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's dpaa2-switch driver and may not have direct detection commands. Monitor kernel logs for errors related to NAPI or dpaa2-switch during device removal. Check if NAPI instances are improperly deleted before ports go down using kernel debugging tools like ftrace or perf.

Impact Analysis

If you use a system with the affected Linux kernel and dpaa2-switch driver, this vulnerability could cause kernel crashes or instability when removing network devices. This may lead to service disruptions, data loss, or require system reboots to recover.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel network driver issue. The flaw involves improper handling of NAPI instances during device removal, which could lead to system instability or crashes but does not involve data exposure or privacy violations typical of GDPR or HIPAA concerns.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this vulnerability. Avoid removing dpaa2-switch ports while the device is in use. Monitor system logs for NAPI-related errors during port removal operations.

Hi! I’m here to help you understand CVE-2026-97434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70