CVE-2026-98630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98630", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.361Z", "datePublished": "2026-10-18T15:19:51.484Z", "dateUpdated": "2026-10-19T09:22:58.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:58.173Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Fix payload page pool error cleanup\n\nThe payload page pool pointer contains an error pointer when its\nallocation fails. The cleanup path passes that error pointer to\npage_pool_destroy() instead of destroying the header page pool. This\ncan dereference the error pointer and leave the header page pool\nallocated.\n\nDestroy the header page pool instead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "versions": [{"version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "lessThan": "f4277b19edbc6abc9e1db7d6f6148608e8cb3c34", "status": "affected", "versionType": "git"}, {"version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "lessThan": "4bab07f7b74e59bb26032fa5ff6969d63e1c52ef", "status": "affected", "versionType": "git"}, {"version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "lessThan": "8e0b235bd918d06f54ba8fddd2c3ddc36ca59c15", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f4277b19edbc6abc9e1db7d6f6148608e8cb3c34"}, {"url": "https://git.kernel.org/stable/c/4bab07f7b74e59bb26032fa5ff6969d63e1c52ef"}, {"url": "https://git.kernel.org/stable/c/8e0b235bd918d06f54ba8fddd2c3ddc36ca59c15"}], "title": "eth: fbnic: Fix payload page pool error cleanup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f4277b19edbc6abc9e1db7d6f6148608e8cb3c34", "status": "affected", "version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "versionType": "git"}, {"lessThan": "4bab07f7b74e59bb26032fa5ff6969d63e1c52ef", "status": "affected", "version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "versionType": "git"}, {"lessThan": "8e0b235bd918d06f54ba8fddd2c3ddc36ca59c15", "status": "affected", "version": "8a11010fdd9615e8dbb2f5d562ab88caa8a9516a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Fix payload page pool error cleanup\n\nThe payload page pool pointer contains an error pointer when its\nallocation fails. The cleanup path passes that error pointer to\npage_pool_destroy() instead of destroying the header page pool. This\ncan dereference the error pointer and leave the header page pool\nallocated.\n\nDestroy the header page pool instead."}], "id": "CVE-2026-98630", "lastModified": "2026-10-19T10:19:27.250", "metrics": {}, "published": "2026-10-18T16:17:16.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4bab07f7b74e59bb26032fa5ff6969d63e1c52ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e0b235bd918d06f54ba8fddd2c3ddc36ca59c15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4277b19edbc6abc9e1db7d6f6148608e8cb3c34"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eth: fbnic: Fix payload page pool error cleanup", "id": "2554935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554935"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["In the Linux kernel, the following vulnerability has been resolved:\neth: fbnic: Fix payload page pool error cleanup\nThe payload page pool pointer contains an error pointer when its\nallocation fails. The cleanup path passes that error pointer to\npage_pool_destroy() instead of destroying the header page pool. This\ncan dereference the error pointer and leave the header page pool\nallocated.\nDestroy the header page pool instead.", "A flaw was found in the Linux kernel's fbnic network driver. When memory allocation for a payload page pool fails, the error cleanup routine incorrectly attempts to destroy an invalid error pointer instead of releasing the allocated header page pool. A local user able to trigger interface queue setup under memory allocation failure conditions can cause an invalid pointer dereference, resulting in a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-98630", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98630\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98630\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98630.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a11010fdd9615e8dbb2f5d562ab88caa8a9516a,f4277b19edbc6abc9e1db7d6f6148608e8cb3c34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a11010fdd9615e8dbb2f5d562ab88caa8a9516a,4bab07f7b74e59bb26032fa5ff6969d63e1c52ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a11010fdd9615e8dbb2f5d562ab88caa8a9516a,8e0b235bd918d06f54ba8fddd2c3ddc36ca59c15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:45:04.779335+00:00", "updated": "2026-10-22T21:45:06.447743+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476", "CWE-401", "CWE-763"]}