{"cve":"CVE-2026-98616","nvd":{"published":"2026-10-18T16:17:14.497","modified":"2026-10-19T10:19:25.627","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ.  The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the\nIRQs, but leaves netif_running() true so resume knows to re-open.  Resume\nrebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets\nnum_napi and __fbnic_open() re-allocates the vectors.\n\nWhen the datapath is torn down but never rebuilt, num_napi is left\npointing at freed vectors under 2 different scenarios:\n - a PCIe error recovery that fails (fbnic_err_slot_reset() ->\n   __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so\n   .resume never runs; or\n - an __fbnic_open() that fails partway on resume and unwinds, freeing\n   the vectors after fbnic_reset_queues() has already set num_napi.\n\nThe netdev is then running with num_napi > 0 but napi[] freed, and the\neventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down()\nand dereferences the freed vectors:\n  BUG: kernel NULL pointer dereference, address: 0000000000000210\n  RIP: fbnic_dbg_down+0x28\n\nClear num_napi when the vectors are freed: in the suspend teardown (a\ngood resume re-establishes it before __fbnic_open()) and on the resume\nopen failure.  A redundant ndo_stop() then walks an empty napi[].  The\nnormal ndo_stop() down/up cycle is untouched and keeps num_napi for the\nnext ndo_open().","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4bcc4a92c603fe7f062cea22e20da2e0ad6b12c3","https://git.kernel.org/stable/c/4f4b767ffea7653a00904383908536e754f8ef5b","https://git.kernel.org/stable/c/c5b5aee41b9f5ed0743344be1c7b544555fa3cb9"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98616","score":0.00166,"percentile":0.05771,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}