CVE-2026-22981

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: detach and close netdevs while handling a reset

Protect the reset path from callbacks by setting the netdevs to detached

state and close any netdevs in UP state until the reset handling has

completed. During a reset, the driver will de-allocate resources for the

vport, and there is no guarantee that those will recover, which is why the

existing vport_ctrl_lock does not provide sufficient protection.

idpf_detach_and_close() is called right before reset handling. If the

reset handling succeeds, the netdevs state is recovered via call to

idpf_attach_and_open(). If the reset handling fails the netdevs remain

down. The detach/down calls are protected with RTNL lock to avoid racing

with callbacks. On the recovery side the attach can be done without

holding the RTNL lock as there are no callbacks expected at that point,

due to detach/close always being done first in that flow.

The previous logic restoring the netdev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References