SB20261022197 - Improper resource shutdown or release in Linux kernel meta fbnic driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-98615)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by leaving a firmware mailbox flush unable to complete.

The vulnerability exists due to improper resource shutdown in fbnic_mbx_reset_desc_ring() in the Linux kernel fbnic driver when tearing down the firmware mailbox receive ring. Clearing BME while setting AW_FLUSH without AW_FLUSH_MODE leaves outstanding write requests parked in the PUL write pipeline. A local privileged user can potentially trigger an affected teardown to prevent the flush awaited by firmware from completing, disrupting device operation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8947f13e436a4ff5eed9f8f019b2865a07af4bb2
• https://git.kernel.org/stable/c/8a052cd4b2caee1f90cf0e3874377066939c90e7
• https://git.kernel.org/stable/c/a969db6548a1b046cd1423701f5f9c3f5794e90d
• https://git.kernel.org/stable/c/ed4163f6ba9b52bfd6216d5215ee7b8eb5072411