CVE-2026-98906 - Vulnerability Details

- net: lan966x: restore RX state on reload failure

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: restore RX state on reload failure

lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before
reallocating the RX resources for the new MTU. If the allocation fails,
the restore path puts these fields back before restarting RX.

However, the reload path also updates rx->page_order and rx->max_mtu
before calling lan966x_fdma_rx_alloc(). These fields are not restored on
failure, so RX can be restarted with the old pages, old FDMA state and
old page pool, but with the page geometry from the failed new MTU.

This can make the XDP path advertise a frame size derived from the new
page_order while the actual RX pages still come from the old allocation.
For example, after a failed reload to a jumbo MTU, xdp_init_buff() may be
called with a frame size larger than the restored RX pages.

lan966x_fdma_rx_alloc_page_pool() also registers the newly allocated page
pool with each port's XDP RXQ before fdma_alloc_coherent() is called. If
fdma_alloc_coherent() fails, the new page pool is destroyed, but the
rollback path does not restore the per-port XDP RXQ mem model
registration either.

Save and restore rx->page_order and rx->max_mtu, and restore the old page
pool registration for each port's XDP RXQ before RX is started again.
This keeps the restored RX state consistent after a failed reload.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The lan966x network driver restores certain fields after a failed MTU reload but fails to restore page order and maximum MTU. This inconsistency causes the XDP path to advertise a frame size derived from an uninitialized or mismatched page geometry, potentially leading to memory corruption or kernel panic. The weakness is an improper restoration of state following an error (CWE-665 and CWE-805). No remote code execution is directly possible from the description.

Affected Systems

All Linux kernel builds that include the lan966x driver are potentially affected. The issue exists in any kernel version that contains the unpatched reload logic. Distribution gradients are not specified, so any system running a kernel prior to the commit that fixed the restore path could be vulnerable.

Risk and Exploitability

The CVSS score of 4.1 and EPSS < 1%, indicating no publicly known exploitation yet. The vulnerability requires the ability to trigger a MTU reload, typically through root-level configuration or network management actions, giving it a local attack vector. Due to the lack of a public exploit and the need for privileged configuration, the overall risk remains low to moderate, but it can lead to denial of service or easier escalation if a kernel crash is achieved.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2ea1cbac267e2a39546982612fc00084b6d93e40`	affected	< 3883898ddc26308497dbba8068951ab5eddbd111
`2ea1cbac267e2a39546982612fc00084b6d93e40`	affected	< b5a6462f4646687c922931133a2478da94addc87
`2ea1cbac267e2a39546982612fc00084b6d93e40`	affected	< aa97f11a76e545ed73cc455bcdd1ece4b480b507

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3883898ddc26308497dbba8068951ab5eddbd111)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b5a6462f4646687c922931133a2478da94addc87)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,aa97f11a76e545ed73cc455bcdd1ece4b480b507)`	affected	code_commit	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3883898ddc26308497dbba8068951ab5eddbd111)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b5a6462f4646687c922931133a2478da94addc87)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,aa97f11a76e545ed73cc455bcdd1ece4b480b507)`	affected	code_commit	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit restoring page_order and max_mtu on reload failure.
Until a patch is available, avoid changing MTU values on interfaces using the lan966x driver or disable the driver on affected systems.
Monitor kernel logs for XDP or lan966x related errors and verify that advertised frame sizes match actual page pool sizes.

Generated by OpenCVE AI on October 27, 2026 at 13:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98906.mbox
https://git.kernel.org/stable/c/3883898ddc26308497dbba8068951ab5eddbd111
https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507
https://git.kernel.org/stable/c/b5a6462f4646687c922931133a2478da94addc87
https://nvd.nist.gov/vuln/detail/CVE-2026-98906
https://www.cve.org/CVERecord?id=CVE-2026-98906

History

Tue, 27 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98906.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98906 https://www.cve.org/CVERecord?id=CVE-2026-98906
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Fri, 23 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before restarting RX. However, the reload path also updates rx->page_order and rx->max_mtu before calling lan966x_fdma_rx_alloc(). These fields are not restored on failure, so RX can be restarted with the old pages, old FDMA state and old page pool, but with the page geometry from the failed new MTU. This can make the XDP path advertise a frame size derived from the new page_order while the actual RX pages still come from the old allocation. For example, after a failed reload to a jumbo MTU, xdp_init_buff() may be called with a frame size larger than the restored RX pages. lan966x_fdma_rx_alloc_page_pool() also registers the newly allocated page pool with each port's XDP RXQ before fdma_alloc_coherent() is called. If fdma_alloc_coherent() fails, the new page pool is destroyed, but the rollback path does not restore the per-port XDP RXQ mem model registration either. Save and restore rx->page_order and rx->max_mtu, and restore the old page pool registration for each port's XDP RXQ before RX is started again. This keeps the restored RX state consistent after a failed reload.
Title		net: lan966x: restore RX state on reload failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3883898ddc26308497dbba8068951ab5eddbd111 https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507 https://git.kernel.org/stable/c/b5a6462f4646687c922931133a2478da94addc87

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:54:42.697Z

Updated: 2026-10-26T06:56:35.317Z

Reserved: 2026-09-25T10:25:14.379Z

Link: CVE-2026-98906

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:24.680

Modified: 2026-10-26T07:17:15.960

Link: CVE-2026-98906

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98906 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T14:00:05Z

Weaknesses

CWE-665
Improper Initialization
CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object