CVE-2026-98617
Received Received - Intake

Use Rx Queue NAPI Pointer in fbnic for Correct Vector Mapping

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn->napi[idx % fbn->num_napi]; The issue is this is only correct in the cases where there are no standalone Tx vectors. In those cases we were allocating the Tx vectors first and then the Rx so the queues would be pointing to Tx NAPI vectors instead of the Rx ones. The mapping the ndos want is already recorded. fbnic_set_netif_napi() publishes it with netif_queue_set_napi(), which stores the napi pointer in netdev_rx_queue.napi, and fbnic_reset_netif_napi() clears it again. Both run under the netdev instance lock that the queue management ndos also hold, so the pointer can be read directly. Use it and drop the divide. The pointer is NULL exactly while the datapath is down, so fbnic_queue_mem_alloc() can reject that case rather than reaching into freed state: netdev_rx_queue_restart() calls it before it tests netif_running(), and fbnic_pm_suspend() leaves netif_running() true across a PCIe recovery that never completes, so a queue restart can arrive after fbnic_stop() has freed the rings and the vectors. fbnic_stop() clears the association in fbnic_reset_netif_queues() before fbnic_free_napi_vectors(), so the NULL is always published first. fbnic_queue_start() and fbnic_queue_stop() need no check of their own, as netdev_rx_queue_reconfig() only reaches them once fbnic_queue_mem_alloc() has succeeded under the same instance lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98617
EUVD
EUVD-2026-103662

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux da43127a8edc7498cce7b2554533f4027c618933
Linux Linux da43127a8edc7498cce7b2554533f4027c618933
Linux Linux 6.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect mapping of NAPI vectors for Rx queues in the fbnic driver. The issue occurs when standalone Tx vectors are present, causing Rx queues to point to Tx NAPI vectors instead of the correct Rx ones. This happens because the queue management functions use a modulo operation to select vectors, which fails when Tx vectors are allocated first.

Detection Guidance

This vulnerability is specific to the Linux kernel's eth: fbnic driver and involves incorrect NAPI vector mapping for Rx queues. Detection requires checking the kernel version and the fbnic driver implementation. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to network performance issues or crashes in systems using the fbnic driver. If Rx queues incorrectly use Tx NAPI vectors, network traffic handling may fail, causing packet loss or system instability. Systems with PCIe recovery or frequent queue restarts are particularly at risk.

Mitigation Strategies

Apply the kernel patch that resolves the issue by using the Rx queue napi pointer to find the correct NAPI vector. Ensure the driver correctly maps Rx queues to NAPI vectors and avoids using standalone Tx vectors. Update to a patched kernel version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart