CVE-2026-98617

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: fbnic: use the Rx queue napi pointer to find the napi vector

The queue management ndos pick the napi vector for an Rx queue with:

nv = fbn->napi[idx % fbn->num_napi];

The issue is this is only correct in the cases where there are no

standalone Tx vectors. In those cases we were allocating the Tx vectors

first and then the Rx so the queues would be pointing to Tx NAPI vectors

instead of the Rx ones.

The mapping the ndos want is already recorded. fbnic_set_netif_napi()

publishes it with netif_queue_set_napi(), which stores the napi pointer

in netdev_rx_queue.napi, and fbnic_reset_netif_napi() clears it again.

Both run under the netdev instance lock that the queue management ndos

also hold, so the pointer can be read directly.

Use it and drop the divide. The pointer is NULL exactly while the

datapath is down, so fbnic_queue_mem_alloc() can reject that case rather

than reaching into freed state: netdev_rx_queu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References