CVE-2026-98616
Received Received - Intake

Use-After-Free in Linux Kernel fbnic Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num_napi when the napi vectors are freed fbn->num_napi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the IRQs, but leaves netif_running() true so resume knows to re-open. Resume rebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets num_napi and __fbnic_open() re-allocates the vectors. When the datapath is torn down but never rebuilt, num_napi is left pointing at freed vectors under 2 different scenarios: - a PCIe error recovery that fails (fbnic_err_slot_reset() -> __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so .resume never runs; or - an __fbnic_open() that fails partway on resume and unwinds, freeing the vectors after fbnic_reset_queues() has already set num_napi. The netdev is then running with num_napi > 0 but napi[] freed, and the eventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down() and dereferences the freed vectors: BUG: kernel NULL pointer dereference, address: 0000000000000210 RIP: fbnic_dbg_down+0x28 Clear num_napi when the vectors are freed: in the suspend teardown (a good resume re-establishes it before __fbnic_open()) and on the resume open failure. A redundant ndo_stop() then walks an empty napi[]. The normal ndo_stop() down/up cycle is untouched and keeps num_napi for the next ndo_open().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98616
EUVD
EUVD-2026-103661

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux bc6107771bb4be3009168cfda24d22131c026fe8
Linux Linux bc6107771bb4be3009168cfda24d22131c026fe8
Linux Linux bc6107771bb4be3009168cfda24d22131c026fe8
Linux Linux 6.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the fbnic driver where the num_napi counter is not reset when NAPI vectors are freed during power management operations. This can lead to a kernel NULL pointer dereference when the driver tries to access freed memory during device removal or error recovery.

Detection Guidance

This vulnerability affects the Linux kernel's fbnic driver and may lead to a kernel NULL pointer dereference. Detection requires checking if the system is running a vulnerable kernel version and if the fbnic driver is in use. Commands like 'uname -a' to check kernel version and 'lsmod | grep fbnic' to verify driver usage may help. Monitor kernel logs for NULL pointer dereference errors.

Impact Analysis

This vulnerability could cause system crashes due to kernel NULL pointer dereference errors. It may affect network connectivity if the fbnic driver is used, potentially leading to denial of service conditions during device operations or error recovery scenarios.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to ensure the vulnerability is fixed. If patches are unavailable, consider disabling the fbnic driver if not in use. Monitor vendor advisories for updates and avoid using affected systems in critical environments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart