CVE-2026-98806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98806", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:48:52.707Z", "dateUpdated": "2026-10-19T09:25:59.674Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:25:59.674Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled\n\nPreviously, BPID assignment under CONFIG_DCB assumed\n`queue_to_pfc_map` was always initialized. For SDP VFs this leads to\ninvalid memory access as it was not initialized.\n\nThis patch adds a NULL check for `queue_to_pfc_map` before\ndereferencing it. Also, simplifies the logic by always assigning a\ndefault BPID first, then conditionally overriding it if CONFIG_DCB is\nenabled and the map exists."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h"], "versions": [{"version": "184fb40f731bd3353b0887731f7caba66609e9cd", "lessThan": "59fbbded05e559675930fd521b8d62b72828b52d", "status": "affected", "versionType": "git"}, {"version": "184fb40f731bd3353b0887731f7caba66609e9cd", "lessThan": "056994563935e049093f100efaad7e63ad113814", "status": "affected", "versionType": "git"}, {"version": "22079d5ae4a33679150f7de89f4107f4e0446886", "status": "affected", "versionType": "git"}, {"version": "6.14.9", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/59fbbded05e559675930fd521b8d62b72828b52d"}, {"url": "https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}], "title": "octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "59fbbded05e559675930fd521b8d62b72828b52d", "status": "affected", "version": "184fb40f731bd3353b0887731f7caba66609e9cd", "versionType": "git"}, {"lessThan": "056994563935e049093f100efaad7e63ad113814", "status": "affected", "version": "184fb40f731bd3353b0887731f7caba66609e9cd", "versionType": "git"}, {"status": "affected", "version": "22079d5ae4a33679150f7de89f4107f4e0446886", "versionType": "git"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c", "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled\n\nPreviously, BPID assignment under CONFIG_DCB assumed\n`queue_to_pfc_map` was always initialized. For SDP VFs this leads to\ninvalid memory access as it was not initialized.\n\nThis patch adds a NULL check for `queue_to_pfc_map` before\ndereferencing it. Also, simplifies the logic by always assigning a\ndefault BPID first, then conditionally overriding it if CONFIG_DCB is\nenabled and the map exists."}], "id": "CVE-2026-98806", "lastModified": "2026-10-19T10:19:44.660", "metrics": {}, "published": "2026-10-18T16:17:34.683", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/056994563935e049093f100efaad7e63ad113814"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59fbbded05e559675930fd521b8d62b72828b52d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled", "id": "2555242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555242"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocteontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled\nPreviously, BPID assignment under CONFIG_DCB assumed\n`queue_to_pfc_map` was always initialized. For SDP VFs this leads to\ninvalid memory access as it was not initialized.\nThis patch adds a NULL check for `queue_to_pfc_map` before\ndereferencing it. Also, simplifies the logic by always assigning a\ndefault BPID first, then conditionally overriding it if CONFIG_DCB is\nenabled and the map exists.", "A flaw was found in the Linux kernel's octeontx2-pf network driver. When Data Center Bridging (DCB) is enabled, the driver assumes traffic queue mapping structures are always initialized, which is not the case for System Data Path (SDP) virtual functions. This issue leads to a NULL pointer dereference during backpressure identifier assignment, allowing a local user to crash the system and cause a Denial of Service (DoS) via an invalid memory access."], "name": "CVE-2026-98806", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98806\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98806\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98806.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[184fb40f731bd3353b0887731f7caba66609e9cd,59fbbded05e559675930fd521b8d62b72828b52d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[184fb40f731bd3353b0887731f7caba66609e9cd,056994563935e049093f100efaad7e63ad113814)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[22079d5ae4a33679150f7de89f4107f4e0446886,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.14.9,6.15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.15,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:45:06.494283+00:00", "updated": "2026-10-24T02:30:17.261812+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}