{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98616", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:36.165Z", "dateUpdated": "2026-10-19T09:22:44.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:44.159Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ. The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open. Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() ->\n __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so\n .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi > 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down()\nand dereferences the freed vectors:\n BUG: kernel NULL pointer dereference, address: 0000000000000210\n RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure. A redundant ndo_stop() then walks an empty napi[]. The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"], "versions": [{"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "c5b5aee41b9f5ed0743344be1c7b544555fa3cb9", "status": "affected", "versionType": "git"}, {"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "4f4b767ffea7653a00904383908536e754f8ef5b", "status": "affected", "versionType": "git"}, {"version": "bc6107771bb4be3009168cfda24d22131c026fe8", "lessThan": "4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"}, {"url": "https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b"}, {"url": "https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}], "title": "eth: fbnic: reset num_napi when the napi vectors are freed", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c5b5aee41b9f5ed0743344be1c7b544555fa3cb9", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}, {"lessThan": "4f4b767ffea7653a00904383908536e754f8ef5b", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}, {"lessThan": "4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3", "status": "affected", "version": "bc6107771bb4be3009168cfda24d22131c026fe8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ. The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open. Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() ->\n __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so\n .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi > 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down()\nand dereferences the freed vectors:\n BUG: kernel NULL pointer dereference, address: 0000000000000210\n RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure. A redundant ndo_stop() then walks an empty napi[]. The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open()."}], "id": "CVE-2026-98616", "lastModified": "2026-10-19T10:19:25.627", "metrics": {}, "published": "2026-10-18T16:17:14.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eth: fbnic: reset num_napi when the napi vectors are freed", "id": "2555019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555019"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service (DoS). During power management suspend or failed resume operations, the driver frees interrupt vectors without clearing the active vector counter. When the network interface is subsequently closed or detached, the driver attempts to access the freed structures, leading to a null pointer dereference."], "name": "CVE-2026-98616", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98616\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98616\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98616.mbox"], "threat_severity": "Moderate"}