CVE-2026-98050

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

Currently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP

garbage-collection workqueue, rather than the NAPI poll context. For any

unmatched PTP entries carrying an SKB, it calls

mlxsw_sp1_ptp_unmatched_finish() -> mlxsw_sp1_ptp_packet_finish(). For

ingress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end

of that function is the following:

skb->protocol = eth_type_trans(skb, skb->dev);

napi_gro_receive(mlxsw_skb_cb(skb)->rx_md_info.napi, skb);

The napi pointer is one that was placed in the SKB control block when the

trapped packet was received in the NAPI context. Later, when the GC reaps

the unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to

napi_gro_receive() mutates the NAPI instance's GRO list, which is unsafe

if the poll is running concurrently on another CPU.

In mlxsw_sp1_ptp_ht_gc_collect

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References