Look up another CVE · open CVE-2026-98050 in the interactive tracker
CVE-2026-98050
mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-98050 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Currently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an SKB, it calls mlxsw_sp1_ptp_unmatched_finish() -> mlxsw_sp1_ptp_packet_finish(). For ingress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end of that function is the following: skb->protocol = eth_type_trans(skb, skb->dev); napi_gro_receive(mlxsw_skb_cb(skb)->rx_md_info.napi, skb); The napi pointer is one that was placed in the SKB control block when the trapped packet was received in the NAPI context. Later, when the GC reaps the unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to napi_gro_receive() mutates the NAPI instance's GRO list, which is unsafe if the poll is running concurrently on another CPU. In mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent softirq processing, but this only applies to the local CPU. Additionally, its comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish() invokes netif_receive_skb(). This has not been accurate since the referenced commit; this patch makes that comment accurate again. mlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX net_device without any conditions. The NAPI instance's poll, which may be running concurrent to the GC, is running as an independently-scheduled kthread which may be on a different CPU. The call to local_bh_disable() does not guard against this. If a tx-timestamp timeout produces an unmatched entry (which can be easily reproduced by running ptp4l and waiting for a port to reach the UNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of a poll on another CPU, both sides mutate the GRO list concurrently, as shown below: [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE list_add corruption. next->prev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138). kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy) Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018 RIP: 0010:__list_add_valid_or_report+0x79/0xb0 RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540 RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003 R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0 Call Trace: <TASK> gro_receive_skb+0xee/0x230 mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum] mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core] mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci] __napi_poll+0x31/0x1e0 napi_threaded_poll_loop+0x16b/0x1c0 napi_threaded_poll+0x71/0xa0 kthread+0xfb/0x260 ret_from_fork+0x22d/0x260 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: Fatal exception in interrupt The machinery that leads to this kernel panic has not been changed between 6.18.48 and mainline. This patch adds an ingress-delivery helper for the PTP packet_finish() path that calls netif_receive_skb() instead of napi_gro_receive(). netif_receive_skb(), unlike napi_gro_receive(), can be called from outside of the NAPI instance's poll context, which can occur at the call site for this path. RX stats accounting and the skb->dev assignment are still preserved; the only change is the delivery call itself. This removes GR ---truncated---
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
- What this is
- MELLANOX ETHERNET SWITCH DRIVERSMAINTAINERS section matched on drivers/net/ethernet/mellanox/mlxsw/ · netdev@vger.kernel.org · Supported
- Kernel module
- none to look for. The file would have gone into mlxsw_spectrum, and Debian does not compile it into that module, so finding mlxsw_spectrum in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_ETHERNET|CONFIG_MLXSW_CORE|CONFIG_MLXSW_SPECTRUM|CONFIG_NET_VENDOR_MELLANOX|CONFIG_PTP_1588_CLOCK' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_ETHERNET, CONFIG_MLXSW_CORE, CONFIG_MLXSW_SPECTRUM, CONFIG_NET_VENDOR_MELLANOX, CONFIG_PTP_1588_CLOCK
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.17%, higher than 6.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.14 | 6.18.53 | 4375b3d1c289 |
| 6.14 | 7.2.7 | 7ddcc460176e |
| 6.14 | 7.3 | 2ac174dfcdde |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The unmatched entries come from PTP event frames (Sync/Delay_Req/Pdelay) received on a Spectrum-1 port and trapped via PTP0 to mlxsw_sp1_ptp_receive(); only a peer on the port's link supplies these normally link-local PTP frames, so the range is adjacent, not routable Network.
- AC:HAttack complexity, high
- Needs Spectrum-1 hardware with admin-enabled RX HW timestamping (ing_types set), an ingress skb left unmatched past MLXSW_SP1_PTP_HT_GC_TIMEOUT, and mlxsw_sp1_ptp_ht_gc_collect() calling napi_gro_receive() while the threaded NAPI poll runs on another CPU; the attacker cannot schedule that cross-CPU overlap.
- PR:NPrivileges required, none
- Received PTP frames are trapped and queued in unmatched_ht without any authentication; the attacker only needs to send frames on the link, while enabling timestamping is the operator's standing configuration.
- UI:NUser interaction, none
- No victim action is needed; the GC delayed work runs every MLXSW_SP1_PTP_HT_GC_INTERVAL on its own and delivers stale ingress skbs.
- S:UScope, unchanged
- The corruption is confined to the host kernel's networking/GRO state, with no crossing of a VM or IOMMU boundary.
- C:HConfidentiality impact, high
- Concurrent unlocked mutation of the NAPI instance's GRO skb list from the GC workqueue and the NAPI poll kthread corrupts list linkage, which can leave skbs freed while still linked (use-after-free), a primitive usable for kernel memory disclosure.
- I:HIntegrity impact, high
- The GRO list corruption (list_add corruption shown in gro_receive_skb) can turn into use-after-free and linked-list writes on kernel skb memory, which could be abused to corrupt kernel memory.
- A:HAvailability impact, high
- The race produces list corruption detected in __list_add_valid_or_report, and the resulting BUG in the napi/mlxsw_rx kthread panics the switch kernel ('Fatal exception in interrupt').