All vulnerabilities
CVE-2026-98967

Linux: cxgb4/ch_ktls: disable softirqs around tid_list erases

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8739f06e3f82cd715f7dd10ab24029ed881efc90Also 7110c7f70c59eb7924e79853bcc00e2a026662e6, 4c9dc0faca98084922caeb689579d338cf3e1c29 and 2 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

cxgb4/ch_ktls: disable softirqs around tid_list erases

chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs.

When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.

Text from CVE List

Affected versions 16

  • Linuxaffected: 65e302a9bd57b62872040d57eea1201562a7cbb2 before 8739f06e3f82cd715f7dd10ab24029ed881efc90CVE List
  • Linuxaffected: 65e302a9bd57b62872040d57eea1201562a7cbb2 before bcf97573d44e277b1744d7f1226f665aa0ccc599CVE List
  • Linuxaffected: 65e302a9bd57b62872040d57eea1201562a7cbb2 before 7110c7f70c59eb7924e79853bcc00e2a026662e6CVE List
  • Linuxaffected: 65e302a9bd57b62872040d57eea1201562a7cbb2 before bea736a2b8c6da5b1078badf1206541b5404250fCVE List
  • Linuxaffected: 65e302a9bd57b62872040d57eea1201562a7cbb2 before 4c9dc0faca98084922caeb689579d338cf3e1c29CVE List
  • Linuxaffected: b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78CVE List
  • Linuxaffected: 70c4ead897211b184f36cbeda213f2a3e8153218CVE List
  • Linuxaffected: 5.10.42 before 5.11CVE List
  • Linuxaffected: 5.12.9 before 5.13CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5