{"id":"CVE-2026-98616","state":"PUBLISHED","title":"eth: fbnic: reset num_napi when the napi vectors are freed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ.  The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open.  Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() ->\n   __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so\n   .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n   the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi > 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down()\nand dereferences the freed vectors:\n  BUG: kernel NULL pointer dereference, address: 0000000000000210\n  RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure.  A redundant ndo_stop() then walks an empty napi[].  The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open().","publishedAt":"2026-10-18T15:19:36.165Z","updatedAt":"2026-10-19T09:22:44.159Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"c5b5aee41b9f5ed0743344be1c7b544555fa3cb9","versionType":"git"},{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"4f4b767ffea7653a00904383908536e754f8ef5b","versionType":"git"},{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"]}],"references":["https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9","https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b","https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98616.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98616","state":"PUBLISHED","datePublished":"2026-10-18T15:19:36.165Z","dateUpdated":"2026-10-19T09:22:44.159Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.360Z"},"containers":{"cna":{"title":"eth: fbnic: reset num_napi when the napi vectors are freed","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ.  The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open.  Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() ->\n   __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so\n   .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n   the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi > 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down()\nand dereferences the freed vectors:\n  BUG: kernel NULL pointer dereference, address: 0000000000000210\n  RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure.  A redundant ndo_stop() then walks an empty napi[].  The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"c5b5aee41b9f5ed0743344be1c7b544555fa3cb9","versionType":"git"},{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"4f4b767ffea7653a00904383908536e754f8ef5b","versionType":"git"},{"version":"bc6107771bb4be3009168cfda24d22131c026fe8","status":"affected","lessThan":"4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_pci.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"},{"url":"https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b"},{"url":"https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:22:44.159Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}