medium

CVE-2026-98619

A race condition in the Linux kernel’s ethtool ETHTOOL_TEST ioctl allows an offline self test to tear down and reconfigure a network interfa

Overview

A race condition in the Linux kernel’s ethtool ETHTOOL_TEST ioctl allows an offline self test to tear down and reconfigure a network interface without holding the required rtnl_lock. This can lead to device instability or crashes on ops‑locked drivers. The issue is limited to the ioctl path and affects specific drivers such as fbnic and bnxt.

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that brings the interface down and back up with netif_close() / netif_open() requires rtnl_lock for both. Since the ethtool IOCTL path became rtnl-optional for ops-locked drivers, the ETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an ops-locked driver the self test now tears the device down without rtnl_lock. With lockdep this reproduces deterministically on every offline self test on such a driver; note the sole lock held is the instance lock, not rtnl: WARNING: suspicious RCU usage net/core/netpoll.c:207 suspicious rcu_dereference_protected() usage! 1 lock held by ethtool/107: #0: (&dev->lock){+.+.}, at: dev_ethtool Call Trace: netpoll_poll_disable __dev_close_many netif_close_many netif_close fbnic_self_test dev_ethtool_locked dev_ethtool dev_ioctl sock_ioctl __x64_sys_ioctl Without lockdep the same condition trips ASSERT_RTNL() in __dev_close_many() / __dev_open(); that check only samples the global rtnl state, so it can be masked by a concurrent rtnl holder, but the device is still being reconfigured without the lock it requires. The ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST case is only needed on the ioctl path. Add an opt-in bit for drivers whose self test needs rtnl_lock and set it on the ops-locked drivers whose offline self test tears the interface down and up: - fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path uses netif_close() / netif_open(). - bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path goes through bnxt_close_nic() / bnxt_half_open_nic() / bnxt_half_close_nic() / bnxt_open_nic(), which close and reopen the device.

Impact

The flaw can compromise the integrity of network device configuration and availability, potentially causing service interruptions. Defenders may observe unexpected interface resets or kernel warnings. Confidentiality is not directly impacted.

Remediation

Apply the official kernel patch that adds an opt‑in rtnl_lock requirement for drivers whose self test performs a full close/open cycle. If patching is not immediately possible, disable the ETHTOOL_TEST ioctl for affected drivers via sysctl or driver configuration, or upgrade to a kernel version that includes the fix.

Risk context

The CVE is rated medium severity with no EPSS data. While not critical, the vulnerability can disrupt network services in environments that rely on offline self tests, warranting timely patching or mitigation.

Affected products

  • fbnic driver
  • bnxt driver
  • Linux kernel

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
—
CVSS v4
—
EPSS
—

kernel ethtool rtnl_lock self_test device_reconfiguration medium_severity

← All CVEs

Related CVEs

medium

CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.

View analysis

medium

CVE-2026-98622

This CVE involves a benign warning in the Linux kernel's traffic control conntrack action that can be triggered by an unprivileged user to cause a kernel panic when panic_on_warn is enabled. The issue arises when flow_offload_alloc() fails during a conntrack flush race. The patch removes the warning, preventing the panic.

View analysis

medium

CVE-2026-98623

CVE-2026-98623 is a medium‑severity vulnerability in the Linux kernel’s Nouveau driver that allows an out‑of‑bounds read via the debugfs interface. The flaw occurs when an invalid pstate ID is supplied to nvkm_clk_ustate_update, causing a kernel memory read. It can potentially expose sensitive kernel data to privileged users.

View analysis

medium

CVE-2026-98630

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to page_pool_destroy() instead of destroying the header page pool. This can dereference the error pointer and leave the header page pool allocated. Destroy the header page pool instead.

View analysis