CVE-2026-98619

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: keep rtnl_lock for the ioctl self test

An offline self test that brings the interface down and back up with

netif_close() / netif_open() requires rtnl_lock for both. Since the

ethtool IOCTL path became rtnl-optional for ops-locked drivers, the

ETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an

ops-locked driver the self test now tears the device down without

rtnl_lock.

With lockdep this reproduces deterministically on every offline self

test on such a driver; note the sole lock held is the instance lock, not

rtnl:

WARNING: suspicious RCU usage

net/core/netpoll.c:207 suspicious rcu_dereference_protected() usage!

1 lock held by ethtool/107:

#0: (&dev->lock){+.+.}, at: dev_ethtool

Call Trace:

netpoll_poll_disable

__dev_close_many

netif_close_many

netif_close

fbnic_self_test

dev_ethtool_locked

dev_ethtool

dev_ioctl

sock_ioctl

__x64_sys_ioctl

W

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References