CVE-2026-98050 (GCVE-0-2026-98050)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41
VLAI
Title
mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
Summary
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context Currently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an SKB, it calls mlxsw_sp1_ptp_unmatched_finish() -> mlxsw_sp1_ptp_packet_finish(). For ingress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end of that function is the following: skb->protocol = eth_type_trans(skb, skb->dev); napi_gro_receive(mlxsw_skb_cb(skb)->rx_md_info.napi, skb); The napi pointer is one that was placed in the SKB control block when the trapped packet was received in the NAPI context. Later, when the GC reaps the unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to napi_gro_receive() mutates the NAPI instance's GRO list, which is unsafe if the poll is running concurrently on another CPU. In mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent softirq processing, but this only applies to the local CPU. Additionally, its comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish() invokes netif_receive_skb(). This has not been accurate since the referenced commit; this patch makes that comment accurate again. mlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX net_device without any conditions. The NAPI instance's poll, which may be running concurrent to the GC, is running as an independently-scheduled kthread which may be on a different CPU. The call to local_bh_disable() does not guard against this. If a tx-timestamp timeout produces an unmatched entry (which can be easily reproduced by running ptp4l and waiting for a port to reach the UNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of a poll on another CPU, both sides mutate the GRO list concurrently, as shown below: [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE list_add corruption. next->prev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138). kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy) Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018 RIP: 0010:__list_add_valid_or_report+0x79/0xb0 RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540 RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003 R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0 Call Trace: <TASK> gro_receive_skb+0xee/0x230 mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum] mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core] mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci] __napi_poll+0x31/0x1e0 napi_threaded_poll_loop+0x16b/0x1c0 napi_threaded_poll+0x71/0xa0 kthread+0xfb/0x260 ret_from_fork+0x22d/0x260 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: Fatal exception in interrupt The machinery that leads to this kernel panic has not been changed between 6.18.48 and mainline. This patch adds an ingress-delivery helper for the PTP packet_finish() path that calls netif_receive_skb() instead of napi_gro_receive(). netif_receive_skb(), unlike napi_gro_receive(), can be called from outside of the NAPI instance's poll context, which can occur at the call site for this path. RX stats accounting and the skb->dev assignment are still preserved; the only change is the delivery call itself. This removes GR ---truncated---
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921 , < 4375b3d1c2898886df1f908160c7004bdd938e73 (git)
Affected: 1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921 , < 7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9 (git)
Affected: 1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921 , < 2ac174dfcdde399fa95ba889541fb5e688d8bb35 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4375b3d1c2898886df1f908160c7004bdd938e73",
              "status": "affected",
              "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
              "versionType": "git"
            },
            {
              "lessThan": "7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9",
              "status": "affected",
              "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
              "versionType": "git"
            },
            {
              "lessThan": "2ac174dfcdde399fa95ba889541fb5e688d8bb35",
              "status": "affected",
              "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context\n\nCurrently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP\ngarbage-collection workqueue, rather than the NAPI poll context. For any\nunmatched PTP entries carrying an SKB, it calls\nmlxsw_sp1_ptp_unmatched_finish() -\u003e mlxsw_sp1_ptp_packet_finish(). For\ningress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end\nof that function is the following:\n\n    skb-\u003eprotocol = eth_type_trans(skb, skb-\u003edev);\n    napi_gro_receive(mlxsw_skb_cb(skb)-\u003erx_md_info.napi, skb);\n\nThe napi pointer is one that was placed in the SKB control block when the\ntrapped packet was received in the NAPI context. Later, when the GC reaps\nthe unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to\nnapi_gro_receive() mutates the NAPI instance\u0027s GRO list, which is unsafe\nif the poll is running concurrently on another CPU.\n\nIn mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent\nsoftirq processing, but this only applies to the local CPU. Additionally,\nits comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish()\ninvokes netif_receive_skb(). This has not been accurate since the\nreferenced commit; this patch makes that comment accurate again.\nmlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX\nnet_device without any conditions. The NAPI instance\u0027s poll, which may be\nrunning concurrent to the GC, is running as an independently-scheduled\nkthread which may be on a different CPU. The call to local_bh_disable()\ndoes not guard against this.\n\nIf a tx-timestamp timeout produces an unmatched entry (which can be easily\nreproduced by running ptp4l and waiting for a port to reach the\nUNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of\na poll on another CPU, both sides mutate the GRO list concurrently, as\nshown below:\n\n  [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE\n  list_add corruption. next-\u003eprev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy)\n  Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018\n  RIP: 0010:__list_add_valid_or_report+0x79/0xb0\n  RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246\n  RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540\n  RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff\n  R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003\n  R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001\n  FS:  0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0\n  Call Trace:\n  \u003cTASK\u003e\n  gro_receive_skb+0xee/0x230\n  mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum]\n  mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core]\n  mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci]\n  __napi_poll+0x31/0x1e0\n  napi_threaded_poll_loop+0x16b/0x1c0\n  napi_threaded_poll+0x71/0xa0\n  kthread+0xfb/0x260\n  ret_from_fork+0x22d/0x260\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe machinery that leads to this kernel panic has not been changed between\n6.18.48 and mainline.\n\nThis patch adds an ingress-delivery helper for the PTP packet_finish()\npath that calls netif_receive_skb() instead of napi_gro_receive().\nnetif_receive_skb(), unlike napi_gro_receive(), can be called from outside\nof the NAPI instance\u0027s poll context, which can occur at the call site for\nthis path. RX stats accounting and the skb-\u003edev assignment are still\npreserved; the only change is the delivery call itself.\n\nThis removes GR\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The unmatched entries come from PTP event frames (Sync/Delay_Req/Pdelay) received on a Spectrum-1 port and trapped via PTP0 to mlxsw_sp1_ptp_receive(); only a peer on the port\u0027s link supplies these normally link-local PTP frames, so the range is adjacent, not routable Network.\nAC:H - Needs Spectrum-1 hardware with admin-enabled RX HW timestamping (ing_types set), an ingress skb left unmatched past MLXSW_SP1_PTP_HT_GC_TIMEOUT, and mlxsw_sp1_ptp_ht_gc_collect() calling napi_gro_receive() while the threaded NAPI poll runs on another CPU; the attacker cannot schedule that cross-CPU overlap.\nPR:N - Received PTP frames are trapped and queued in unmatched_ht without any authentication; the attacker only needs to send frames on the link, while enabling timestamping is the operator\u0027s standing configuration.\nUI:N - No victim action is needed; the GC delayed work runs every MLXSW_SP1_PTP_HT_GC_INTERVAL on its own and delivers stale ingress skbs.\nS:U - The corruption is confined to the host kernel\u0027s networking/GRO state, with no crossing of a VM or IOMMU boundary.\nC:H - Concurrent unlocked mutation of the NAPI instance\u0027s GRO skb list from the GC workqueue and the NAPI poll kthread corrupts list linkage, which can leave skbs freed while still linked (use-after-free), a primitive usable for kernel memory disclosure.\nI:H - The GRO list corruption (list_add corruption shown in gro_receive_skb) can turn into use-after-free and linked-list writes on kernel skb memory, which could be abused to corrupt kernel memory.\nA:H - The race produces list corruption detected in __list_add_valid_or_report, and the resulting BUG in the napi/mlxsw_rx kthread panics the switch kernel (\u0027Fatal exception in interrupt\u0027)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:57.023Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4375b3d1c2898886df1f908160c7004bdd938e73"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ac174dfcdde399fa95ba889541fb5e688d8bb35"
        }
      ],
      "title": "mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98050",
    "datePublished": "2026-09-25T10:23:59.198Z",
    "dateReserved": "2026-09-25T10:19:56.072Z",
    "dateUpdated": "2026-09-25T14:41:57.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98050",
      "date": "2026-09-26",
      "epss": "0.00223",
      "percentile": "0.11655"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4375b3d1c2898886df1f908160c7004bdd938e73",
                    "status": "affected",
                    "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9",
                    "status": "affected",
                    "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ac174dfcdde399fa95ba889541fb5e688d8bb35",
                    "status": "affected",
                    "version": "1ba06ca96ca255c079ce5ea6a75cc0bfd5e97921",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context\n\nCurrently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP\ngarbage-collection workqueue, rather than the NAPI poll context. For any\nunmatched PTP entries carrying an SKB, it calls\nmlxsw_sp1_ptp_unmatched_finish() -\u003e mlxsw_sp1_ptp_packet_finish(). For\ningress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end\nof that function is the following:\n\n    skb-\u003eprotocol = eth_type_trans(skb, skb-\u003edev);\n    napi_gro_receive(mlxsw_skb_cb(skb)-\u003erx_md_info.napi, skb);\n\nThe napi pointer is one that was placed in the SKB control block when the\ntrapped packet was received in the NAPI context. Later, when the GC reaps\nthe unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to\nnapi_gro_receive() mutates the NAPI instance\u0027s GRO list, which is unsafe\nif the poll is running concurrently on another CPU.\n\nIn mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent\nsoftirq processing, but this only applies to the local CPU. Additionally,\nits comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish()\ninvokes netif_receive_skb(). This has not been accurate since the\nreferenced commit; this patch makes that comment accurate again.\nmlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX\nnet_device without any conditions. The NAPI instance\u0027s poll, which may be\nrunning concurrent to the GC, is running as an independently-scheduled\nkthread which may be on a different CPU. The call to local_bh_disable()\ndoes not guard against this.\n\nIf a tx-timestamp timeout produces an unmatched entry (which can be easily\nreproduced by running ptp4l and waiting for a port to reach the\nUNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of\na poll on another CPU, both sides mutate the GRO list concurrently, as\nshown below:\n\n  [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE\n  list_add corruption. next-\u003eprev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy)\n  Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018\n  RIP: 0010:__list_add_valid_or_report+0x79/0xb0\n  RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246\n  RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540\n  RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff\n  R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003\n  R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001\n  FS:  0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0\n  Call Trace:\n  \u003cTASK\u003e\n  gro_receive_skb+0xee/0x230\n  mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum]\n  mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core]\n  mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci]\n  __napi_poll+0x31/0x1e0\n  napi_threaded_poll_loop+0x16b/0x1c0\n  napi_threaded_poll+0x71/0xa0\n  kthread+0xfb/0x260\n  ret_from_fork+0x22d/0x260\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe machinery that leads to this kernel panic has not been changed between\n6.18.48 and mainline.\n\nThis patch adds an ingress-delivery helper for the PTP packet_finish()\npath that calls netif_receive_skb() instead of napi_gro_receive().\nnetif_receive_skb(), unlike napi_gro_receive(), can be called from outside\nof the NAPI instance\u0027s poll context, which can occur at the call site for\nthis path. RX stats accounting and the skb-\u003edev assignment are still\npreserved; the only change is the delivery call itself.\n\nThis removes GR\n---truncated---"
          }
        ],
        "id": "CVE-2026-98050",
        "lastModified": "2026-09-25T15:18:04.867",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:33.873",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2ac174dfcdde399fa95ba889541fb5e688d8bb35"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4375b3d1c2898886df1f908160c7004bdd938e73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.