CVE-2026-97603

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: disable DIM work before freeing q_vectors

idpf never drains the Tx/Rx DIM works before freeing the memory they

live in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they

are queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel()

ends with kfree(rsrc->q_vectors). Nothing in the driver cancels them.

idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory:

idpf_vport_intr_write_itr() writes the ITR register through

q_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of

the freed q_vector. No configuration is needed to get there --

IDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc()

initialises both modes to IDPF_ITR_DYNAMIC.

Draining after idpf_vport_intr_napi_dis_all() is not enough on its own.

idpf_net_dim() is called from inside the

"if (napi_complete_done(napi, work_done))" branch of the poll, and

napi_complete_done() has already cleared

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References