CVE-2026-98619

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98619", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:39.448Z", "dateUpdated": "2026-10-19T09:22:47.182Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:47.182Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: keep rtnl_lock for the ioctl self test\n\nAn offline self test that brings the interface down and back up with\nnetif_close() / netif_open() requires rtnl_lock for both. Since the\nethtool IOCTL path became rtnl-optional for ops-locked drivers, the\nETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an\nops-locked driver the self test now tears the device down without\nrtnl_lock.\n\nWith lockdep this reproduces deterministically on every offline self\ntest on such a driver; note the sole lock held is the instance lock, not\nrtnl:\n\n WARNING: suspicious RCU usage\n net/core/netpoll.c:207 suspicious rcu_dereference_protected() usage!\n 1 lock held by ethtool/107:\n #0: (&dev->lock){+.+.}, at: dev_ethtool\n Call Trace:\n netpoll_poll_disable\n __dev_close_many\n netif_close_many\n netif_close\n fbnic_self_test\n dev_ethtool_locked\n dev_ethtool\n dev_ioctl\n sock_ioctl\n __x64_sys_ioctl\n\nWithout lockdep the same condition trips ASSERT_RTNL() in\n__dev_close_many() / __dev_open(); that check only samples the global\nrtnl state, so it can be masked by a concurrent rtnl holder, but the\ndevice is still being reconfigured without the lock it requires.\n\nThe ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST\ncase is only needed on the ioctl path. Add an opt-in bit for drivers whose\nself test needs rtnl_lock and set it on the ops-locked drivers whose\noffline self test tears the interface down and up:\n\n - fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path\n uses netif_close() / netif_open().\n - bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path\n goes through bnxt_close_nic() / bnxt_half_open_nic() /\n bnxt_half_close_nic() / bnxt_open_nic(), which close and reopen the\n device."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c", "drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c", "include/linux/ethtool.h", "net/ethtool/common.h"], "versions": [{"version": "f994752b11273ded7ec6b49ae5c1d319eef21743", "lessThan": "4ca1503491f1f25a954c13ac5775bf6775c5abc8", "status": "affected", "versionType": "git"}, {"version": "f994752b11273ded7ec6b49ae5c1d319eef21743", "lessThan": "1b82958f3f035df5ccaab5430a2302f08a5d5351", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c", "drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c", "include/linux/ethtool.h", "net/ethtool/common.h"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4ca1503491f1f25a954c13ac5775bf6775c5abc8"}, {"url": "https://git.kernel.org/stable/c/1b82958f3f035df5ccaab5430a2302f08a5d5351"}], "title": "net: ethtool: keep rtnl_lock for the ioctl self test", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c", "drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c", "include/linux/ethtool.h", "net/ethtool/common.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4ca1503491f1f25a954c13ac5775bf6775c5abc8", "status": "affected", "version": "f994752b11273ded7ec6b49ae5c1d319eef21743", "versionType": "git"}, {"lessThan": "1b82958f3f035df5ccaab5430a2302f08a5d5351", "status": "affected", "version": "f994752b11273ded7ec6b49ae5c1d319eef21743", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c", "drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c", "include/linux/ethtool.h", "net/ethtool/common.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: keep rtnl_lock for the ioctl self test\n\nAn offline self test that brings the interface down and back up with\nnetif_close() / netif_open() requires rtnl_lock for both. Since the\nethtool IOCTL path became rtnl-optional for ops-locked drivers, the\nETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an\nops-locked driver the self test now tears the device down without\nrtnl_lock.\n\nWith lockdep this reproduces deterministically on every offline self\ntest on such a driver; note the sole lock held is the instance lock, not\nrtnl:\n\n WARNING: suspicious RCU usage\n net/core/netpoll.c:207 suspicious rcu_dereference_protected() usage!\n 1 lock held by ethtool/107:\n #0: (&dev->lock){+.+.}, at: dev_ethtool\n Call Trace:\n netpoll_poll_disable\n __dev_close_many\n netif_close_many\n netif_close\n fbnic_self_test\n dev_ethtool_locked\n dev_ethtool\n dev_ioctl\n sock_ioctl\n __x64_sys_ioctl\n\nWithout lockdep the same condition trips ASSERT_RTNL() in\n__dev_close_many() / __dev_open(); that check only samples the global\nrtnl state, so it can be masked by a concurrent rtnl holder, but the\ndevice is still being reconfigured without the lock it requires.\n\nThe ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST\ncase is only needed on the ioctl path. Add an opt-in bit for drivers whose\nself test needs rtnl_lock and set it on the ops-locked drivers whose\noffline self test tears the interface down and up:\n\n - fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path\n uses netif_close() / netif_open().\n - bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path\n goes through bnxt_close_nic() / bnxt_half_open_nic() /\n bnxt_half_close_nic() / bnxt_open_nic(), which close and reopen the\n device."}], "id": "CVE-2026-98619", "lastModified": "2026-10-19T10:19:26.000", "metrics": {}, "published": "2026-10-18T16:17:14.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b82958f3f035df5ccaab5430a2302f08a5d5351"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ca1503491f1f25a954c13ac5775bf6775c5abc8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ethtool: keep rtnl_lock for the ioctl self test", "id": "2554994", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554994"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ethtool: keep rtnl_lock for the ioctl self test\nAn offline self test that brings the interface down and back up with\nnetif_close() / netif_open() requires rtnl_lock for both. Since the\nethtool IOCTL path became rtnl-optional for ops-locked drivers, the\nETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an\nops-locked driver the self test now tears the device down without\nrtnl_lock.\nWith lockdep this reproduces deterministically on every offline self\ntest on such a driver; note the sole lock held is the instance lock, not\nrtnl:\nWARNING: suspicious RCU usage\nnet/core/netpoll.c:207 suspicious rcu_dereference_protected() usage!\n1 lock held by ethtool/107:\n#0: (&dev->lock){+.+.}, at: dev_ethtool\nCall Trace:\nnetpoll_poll_disable\n__dev_close_many\nnetif_close_many\nnetif_close\nfbnic_self_test\ndev_ethtool_locked\ndev_ethtool\ndev_ioctl\nsock_ioctl\n__x64_sys_ioctl\nWithout lockdep the same condition trips ASSERT_RTNL() in\n__dev_close_many() / __dev_open(); that check only samples the global\nrtnl state, so it can be masked by a concurrent rtnl holder, but the\ndevice is still being reconfigured without the lock it requires.\nThe ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST\ncase is only needed on the ioctl path. Add an opt-in bit for drivers whose\nself test needs rtnl_lock and set it on the ops-locked drivers whose\noffline self test tears the interface down and up:\n- fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path\nuses netif_close() / netif_open().\n- bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path\ngoes through bnxt_close_nic() / bnxt_half_open_nic() /\nbnxt_half_close_nic() / bnxt_open_nic(), which close and reopen the\ndevice.", "A flaw was found in the Linux kernel's ethtool subsystem. A local user with network administration privileges can cause a Denial of Service (DoS) by initiating an offline self-test on affected network drivers. Because the test routine fails to hold the necessary synchronization locks when taking the network interface offline and bringing it back online, concurrent operations can trigger race conditions, assertion failures, or kernel crashes."], "name": "CVE-2026-98619", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98619\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98619\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98619.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f994752b11273ded7ec6b49ae5c1d319eef21743,4ca1503491f1f25a954c13ac5775bf6775c5abc8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f994752b11273ded7ec6b49ae5c1d319eef21743,1b82958f3f035df5ccaab5430a2302f08a5d5351)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.9,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:45:04.779903+00:00", "updated": "2026-10-23T07:00:17.012534+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}