SB20261022199 - Incorrect calculation in Linux kernel meta fbnic driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-98617)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by disrupting receive queue processing.

The vulnerability exists due to incorrect calculation of NAPI vector indices in the Linux kernel fbnic driver's queue management operations when managing receive queues with standalone transmit vectors present. A local privileged user can trigger receive queue reconfiguration to make queue operations use transmit NAPI vectors instead of the corresponding receive vectors, potentially disrupting network processing.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1fb569cf3bf97e552f465b2c719e36b48ae7c18b
• https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e