Description
In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: reset HTB scheduler topology before freeing queues

HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler
queues via otx2_qos_txschq_set_parent_topology(), but teardown freed
those queues without clearing TOPOLOGY. The AF only restores PARENT and
SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the
shared scheduler pool and affect later allocations.

Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero
TL4 through TL2 TOPOLOGY before each schq is returned to the AF during
hierarchy teardown and cfg rollback. Skip the aggregation level (TL1):
it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,
and is not freed back to the AF by nix_txschq_free_one().
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: QoS scheduler state leakage
Action: Patch Kernel
AI Analysis

Impact

In the Linux kernel, a defect in the octeontx2-pf driver caused HTB scheduler topology data to persist after queue deallocation. The residual PRIO_ANCHOR/RR_PRIO settings could survive in a shared scheduler pool and influence later queue allocations, allowing a privileged component to indirectly alter QoS parameters for unrelated workloads. This flaw represents improper resource manipulation and could degrade performance or lead to unexpected packet scheduling behavior.

Affected Systems

The vulnerability affects all Linux kernel builds that include the octeontx2 platform networking driver, used on Octeon TX2-based systems. Kernel packages that contain the octeontx2-pf driver and have not been updated after the patch adding otx2_qos_reset_schq_topology and otx2_qos_free_hw_schq are impacted. Specific kernel versions were not listed, so any build with the vulnerable driver is at risk.

Risk and Exploitability

CVSS and EPSS scores are not available and the vulnerability is not in the CISA KEV catalog. The defect exists at kernel privilege level, so a local attacker with kernel or privileged driver access could potentially exploit the residual topology for malicious configuration changes. Because no public exploit is reported, the current risk is moderate, but patching remains the sole mitigative action.

Generated by OpenCVE AI on September 25, 2026 at 14:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install or upgrade the Linux kernel to a version that contains the patch adding otx2_qos_reset_schq_topology and otx2_qos_free_hw_schq.
  • If a kernel update is unavailable, disable the HTB offload functionality for octeontx2-pf to prevent residual state from affecting queue allocation.
  • Restrict privileged access to the Octeon TX2 hardware and monitor system logs for anomalous scheduler behavior after applying the fix.

Generated by OpenCVE AI on September 25, 2026 at 14:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler queues via otx2_qos_txschq_set_parent_topology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the shared scheduler pool and affect later allocations. Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nix_txschq_free_one().
Title octeontx2-pf: reset HTB scheduler topology before freeing queues
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:23:08.543Z

Reserved: 2026-09-25T10:18:58.206Z

Link: CVE-2026-97966

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:24.413

Modified: 2026-09-25T11:17:24.413

Link: CVE-2026-97966

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T14:45:18Z

Weaknesses