FKIE_CVE-2026-72409

Vulnerability from fkie_nvd - Published: 2026-08-15 06:22 - Updated: 2026-08-17 06:19
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules NAPI poll, which calls enable_percpu_irq() on completion to unmask. If suspend occurs while NAPI poll is pending (between disable_percpu_irq in the ISR and enable_percpu_irq in poll completion), the interrupt is never re-enabled: 1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule() => MPIC masked, percpu_enabled cpumask bit cleared 2. NAPI poll does not complete before suspend proceeds (on PREEMPT_RT this is highly likely since softirqs run in ksoftirqd which gets frozen; on non-RT it can happen when softirq processing is deferred to ksoftirqd) 3. mvneta_stop_dev => napi_disable(): cancels the pending poll without executing the completion path 4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC (already masked, but records IRQS_SUSPENDED) 5. Resume: mpic_resume checks irq_percpu_is_enabled() => false (bit was cleared in step 1) => skips unmask 6. mvneta_start_dev only restores device-level INTR_NEW_MASK, does not touch the MPIC per-CPU mask Result: MPIC per-CPU interrupt stays masked permanently. The NIC generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never receives them, causing complete loss of network connectivity. Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt regardless of pre-suspend state.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1cc312dc8bc78fa24c80d5bc193dbf5b57a99cc6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5bdb33ff6e58bdc43632e98b30723eb65352d671
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/82c13027ed283b856017adee970dbfdffce5c6b8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8c7a489aa71d2693752b2e794a68bf672d16c829
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b84dd48f9da1eb132bdc06a944423cd5a1641ef1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/be626ac1faadd49c2cead9f9cd06ba8752d81563
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf88cd3b649bc3e638f1e8a77649581852747a68
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fd398d6480987e4c84fff0aaab6b9d6642a93343
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvneta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf88cd3b649bc3e638f1e8a77649581852747a68",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "8c7a489aa71d2693752b2e794a68bf672d16c829",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "82c13027ed283b856017adee970dbfdffce5c6b8",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "be626ac1faadd49c2cead9f9cd06ba8752d81563",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "1cc312dc8bc78fa24c80d5bc193dbf5b57a99cc6",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "b84dd48f9da1eb132bdc06a944423cd5a1641ef1",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "5bdb33ff6e58bdc43632e98b30723eb65352d671",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            },
            {
              "lessThan": "fd398d6480987e4c84fff0aaab6b9d6642a93343",
              "status": "affected",
              "version": "12bb03b436dad56692e9a103ed26156156bef5d2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvneta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvneta: re-enable percpu interrupt on resume\n\nOn Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu\nIRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls\ndisable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules\nNAPI poll, which calls enable_percpu_irq() on completion to unmask.\n\nIf suspend occurs while NAPI poll is pending (between\ndisable_percpu_irq in the ISR and enable_percpu_irq in poll\ncompletion), the interrupt is never re-enabled:\n\n  1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule()\n     =\u003e MPIC masked, percpu_enabled cpumask bit cleared\n  2. NAPI poll does not complete before suspend proceeds\n     (on PREEMPT_RT this is highly likely since softirqs run in\n     ksoftirqd which gets frozen; on non-RT it can happen when\n     softirq processing is deferred to ksoftirqd)\n  3. mvneta_stop_dev =\u003e napi_disable(): cancels the pending poll\n     without executing the completion path\n  4. suspend_device_irqs =\u003e IRQCHIP_MASK_ON_SUSPEND: masks MPIC\n     (already masked, but records IRQS_SUSPENDED)\n  5. Resume: mpic_resume checks irq_percpu_is_enabled() =\u003e false\n     (bit was cleared in step 1) =\u003e skips unmask\n  6. mvneta_start_dev only restores device-level INTR_NEW_MASK,\n     does not touch the MPIC per-CPU mask\n\nResult: MPIC per-CPU interrupt stays masked permanently. The NIC\ngenerates interrupts (INTR_NEW_CAUSE != 0) but the CPU never\nreceives them, causing complete loss of network connectivity.\n\nFix by calling on_each_cpu(mvneta_percpu_enable) in the resume path\nto unconditionally unmask the MPIC per-CPU interrupt regardless of\npre-suspend state."
    }
  ],
  "id": "CVE-2026-72409",
  "lastModified": "2026-08-17T06:19:07.680",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:22:14.493",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1cc312dc8bc78fa24c80d5bc193dbf5b57a99cc6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5bdb33ff6e58bdc43632e98b30723eb65352d671"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/82c13027ed283b856017adee970dbfdffce5c6b8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8c7a489aa71d2693752b2e794a68bf672d16c829"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b84dd48f9da1eb132bdc06a944423cd5a1641ef1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/be626ac1faadd49c2cead9f9cd06ba8752d81563"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bf88cd3b649bc3e638f1e8a77649581852747a68"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fd398d6480987e4c84fff0aaab6b9d6642a93343"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.