CVE-2026-90098

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sparx5: fix sleep in atomic context in MAC table access

sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates

dev->mc via __dev_mc_sync(), which per address calls sparx5_mc_sync() /

sparx5_mc_unsync() -> sparx5_mact_learn() / sparx5_mact_forget(). These

take sparx5->lock, a mutex, and then poll the MAC access command

register with readx_poll_timeout(). A mutex may block, which is not

allowed from atomic context.

Convert the driver to the new .ndo_set_rx_mode_async callback introduced

in commit 3554b4345d85 ("net: introduce ndo_set_rx_mode_async and

netdev_rx_mode_work"). The async callback is invoked from process

context, so the mutex and sleeping completion poll can remain.

Observed with CONFIG_PROVE_LOCKING, CONFIG_DEBUG_SPINLOCK,

CONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_ATOMIC_SLEEP enabled:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591

in_atomic(): 1, irq

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References