CVE-2026-98616

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: fbnic: reset num_napi when the napi vectors are freed

fbn->num_napi is the count of live napi vectors, each of which owns an

IRQ. The PM path had freed them without clearing the count.

fbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the

IRQs, but leaves netif_running() true so resume knows to re-open. Resume

rebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets

num_napi and __fbnic_open() re-allocates the vectors.

When the datapath is torn down but never rebuilt, num_napi is left

pointing at freed vectors under 2 different scenarios:

- a PCIe error recovery that fails (fbnic_err_slot_reset() ->

__fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so

.resume never runs; or

- an __fbnic_open() that fails partway on resume and unwinds, freeing

the vectors after fbnic_reset_queues() has already set num_napi.

The netdev is then running with num_na

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References