{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "bc6107771bb4be3009168cfda24d22131c026fe8"
            },
            {
              "fixed": "c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"
            },
            {
              "fixed": "4f4b767ffea7653a00904383908536e754f8ef5b"
            },
            {
              "fixed": "4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.11.0"
            },
            {
              "fixed": "6.18.55"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98616.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn-\u003enum_napi is the count of live napi vectors, each of which owns an\nIRQ.  The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open.  Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() -\u003e\n   __fbnic_pm_resume() returns an error -\u003e PCI_ERS_RESULT_DISCONNECT), so\n   .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n   the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi \u003e 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -\u003e fbnic_dbg_down()\nand dereferences the freed vectors:\n  BUG: kernel NULL pointer dereference, address: 0000000000000210\n  RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure.  A redundant ndo_stop() then walks an empty napi[].  The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open().",
  "id": "CVE-2026-98616",
  "modified": "2026-10-20T02:30:41.749488085Z",
  "published": "2026-10-18T15:19:36.165Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98616.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98616"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "eth: fbnic: reset num_napi when the napi vectors are freed"
}