CVE-2026-98967 - Vulnerability Details

- cxgb4/ch_ktls: disable softirqs around tid_list erases

Description

In the Linux kernel, the following vulnerability has been resolved:

cxgb4/ch_ktls: disable softirqs around tid_list erases

chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path
using xa_insert_bh(). The array is shared by the adapter's connections
and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and
the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray
lock without disabling softirqs.

When cleanup runs with softirqs enabled, a receive softirq for another
connection on the same CPU can interrupt the erase and spin on the lock
held by the interrupted task. Use xa_erase_bh() at both sites to match
the insertion path.

Published: 2026-10-23

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A concurrency bug in the Linux cXGB4 driver allows a receive softirq to interrupt a flush operation on the shared XArray without disabling softirqs, causing the receiving task to spin on a lock held by the interrupted task. This race condition can make the kernel’s networking stack unresponsive, effectively denying network service for the affected CPU. The bug manifests when tid_list entries are erased while softirqs remain enabled, a scenario that is logically incorrect according to the kernel’s locking requirements.

Affected Systems

Linux kernel implementations featuring the cXGB4 network driver. No specific kernel release numbers are listed in the available data, so all current kernels with this driver present are potentially affected.

Risk and Exploitability

The EPSS score is less than 1%, and the CVSS is 5.9, indicating moderate risk. It is not listed in the KEV catalog. The likely attack vector requires generating network traffic that triggers a receive softirq on a CPU where the driver is actively erasing entries. No public exploitation examples exist, but the impact is a denial of service that could be triggered by either local or remote actors who can induce the packet path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78`	affected	< 2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< bafe51bb145e6ae549ae79dcbc35648292625934
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< 0c5063a898813a420e6bad93debd134ef8b3bfd1
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< 8739f06e3f82cd715f7dd10ab24029ed881efc90
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< bcf97573d44e277b1744d7f1226f665aa0ccc599
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< 7110c7f70c59eb7924e79853bcc00e2a026662e6
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< bea736a2b8c6da5b1078badf1206541b5404250f
`65e302a9bd57b62872040d57eea1201562a7cbb2`	affected	< 4c9dc0faca98084922caeb689579d338cf3e1c29
`70c4ead897211b184f36cbeda213f2a3e8153218`	affected	—
`5.10.42`	affected	< 5.10.273
`5.12.9`	affected	< 5.13

Linux

affected

Version	Status	Constraints
`5.13`	affected	—
`0`	unaffected	< 5.13
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[65e302a9bd57b62872040d57eea1201562a7cbb2,8739f06e3f82cd715f7dd10ab24029ed881efc90)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,bcf97573d44e277b1744d7f1226f665aa0ccc599)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,7110c7f70c59eb7924e79853bcc00e2a026662e6)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,bea736a2b8c6da5b1078badf1206541b5404250f)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,4c9dc0faca98084922caeb689579d338cf3e1c29)`	affected	code_commit	—
`b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78`	affected	code_commit	—
`70c4ead897211b184f36cbeda213f2a3e8153218`	affected	code_commit	—
`[5.10.42,5.11)`	affected	semver	—
`[5.12.9,5.13)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`5.13`	affected	semver	—
`[0,5.13)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*)`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[65e302a9bd57b62872040d57eea1201562a7cbb2,8739f06e3f82cd715f7dd10ab24029ed881efc90)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,bcf97573d44e277b1744d7f1226f665aa0ccc599)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,7110c7f70c59eb7924e79853bcc00e2a026662e6)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,bea736a2b8c6da5b1078badf1206541b5404250f)`	affected	code_commit	—
`[65e302a9bd57b62872040d57eea1201562a7cbb2,4c9dc0faca98084922caeb689579d338cf3e1c29)`	affected	code_commit	—
`b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78`	affected	code_commit	—
`70c4ead897211b184f36cbeda213f2a3e8153218`	affected	code_commit	—
`[5.10.42,5.11)`	affected	semver	—
`[5.12.9,5.13)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.13`	affected	semver	—
`[0,5.13)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that replaces the call to xa_erase() with xa_erase_bh() in the cXGB4 driver.
If a kernel upgrade is not immediately possible, reduce traffic on the affected NIC and restart the driver to flush pending softirqs.
Continuously monitor the kernel’s networking state and reboot the system if the NIC becomes unresponsive.

Generated by OpenCVE AI on October 29, 2026 at 14:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98967.mbox
https://git.kernel.org/stable/c/0c5063a898813a420e6bad93debd134ef8b3bfd1
https://git.kernel.org/stable/c/2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe
https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29
https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6
https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90
https://git.kernel.org/stable/c/bafe51bb145e6ae549ae79dcbc35648292625934
https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599
https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f
https://nvd.nist.gov/vuln/detail/CVE-2026-98967
https://www.cve.org/CVERecord?id=CVE-2026-98967

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0c5063a898813a420e6bad93debd134ef8b3bfd1 https://git.kernel.org/stable/c/2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe https://git.kernel.org/stable/c/bafe51bb145e6ae549ae79dcbc35648292625934

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98967.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98967 https://www.cve.org/CVERecord?id=CVE-2026-98967
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs. When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.
Title		cxgb4/ch_ktls: disable softirqs around tid_list erases
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29 https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6 https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90 https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599 https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:19:37.625Z

Updated: 2026-10-30T12:40:33.620Z

Reserved: 2026-09-25T10:25:14.383Z

Link: CVE-2026-98967

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:18.187

Modified: 2026-10-30T13:21:33.090

Link: CVE-2026-98967

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98967 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T14:30:16Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object