CVE-2026-98615
Received Received - Intake

fbnic Mailbox Flush Mode Missing in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnic_mbx_reset_desc_ring() writes AW_CFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts the device's writes to the host but leaves the staged requests parked in the PUL write pipeline rather than draining them, so on the write path FLUSH alone never terminates the outstanding requests and the flush the firmware waits on never completes. Add the FLUSH_MODE definition and set both bits so the staged writes drain out of the pipeline on their own. BME stays cleared, so nothing lands on the host; it is restored later in fbnic_mbx_init_desc_ring() when the ring is rebuilt, once the outstanding writes are gone. The read path is unaffected. AR_CFG has no equivalent mode bit and AR_FLUSH terminates the outstanding reads by itself, so it is left as is. Both writes remain plain stores rather than read-modify-writes. That is deliberate: the matching write in fbnic_mbx_init_desc_ring() restores BME and the TLP attributes, and clears both flush bits as a side effect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98615
EUVD
EUVD-2026-103660

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux fea860a2a6136658708fb530a82d59d29f708b74
Linux Linux 3b12f00ddd08e888273b2ac0488d396d90a836fc
Linux Linux 3b12f00ddd08e888273b2ac0488d396d90a836fc
Linux Linux 3b12f00ddd08e888273b2ac0488d396d90a836fc
Linux Linux 0a4aa8a32ddb96f320173a2e9b0e41f4a6d3746c
Linux Linux 6.12.29
Linux Linux 6.14.7
Linux Linux 6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of mailbox flush operations in the fbnic driver. When tearing down the firmware mailbox Rx ring, the function fbnic_mbx_reset_desc_ring() clears certain bits in the AW_CFG register but fails to set AW_FLUSH_MODE alongside AW_FLUSH. This leaves staged write requests in the pipeline, causing the flush operation to never complete and leaving the firmware waiting indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbnic driver and involves mailbox flush operations. Detection requires checking for kernel logs or driver errors related to fbnic or mailbox operations. Commands like dmesg | grep fbnic or journalctl -k | grep fbnic may help identify issues.

Impact Analysis

This vulnerability could lead to system hangs or crashes during mailbox operations in systems using the affected Linux kernel driver. It may cause the firmware to wait indefinitely for a flush operation that never completes, potentially disrupting network or device functionality.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Monitor kernel updates from your distribution and apply them promptly. No additional commands are needed beyond standard kernel update procedures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart