CVE-2026-98967cxgb4/ch_ktls: disable softirqs around tid_list erases
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs. When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 23, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | from 65e302a9bd57b62872040d57eea1201562a7cbb2 before 8739f06e3f82cd715f7dd10ab24029ed881efc90; from 65e302a9bd57b62872040d57eea1201562a7cbb2 before bcf97573d44e277b1744d7f1226f665aa0ccc599; from 65e302a9bd57b62872040d57eea1201562a7cbb2 before 7110c7f70c59eb7924e79853bcc00e2a026662e6; from 65e302a9bd57b62872040d57eea1201562a7cbb2 before bea736a2b8c6da5b1078badf1206541b5404250f; 65e302a9bd57b62872040d57eea1201562a7cbb2 builds before 4c9dc0faca98084922caeb689579d338cf3e1c29; b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78; 70c4ead897211b184f36cbeda213f2a3e8153218; from 5.10.42 before 5.11; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90
- https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599
- https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6
- https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f
- https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.