CVE-2026-98967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98967", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:37.625Z", "dateUpdated": "2026-10-30T12:40:33.620Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:33.620Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxgb4/ch_ktls: disable softirqs around tid_list erases\n\nchcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path\nusing xa_insert_bh(). The array is shared by the adapter's connections\nand initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and\nthe chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray\nlock without disabling softirqs.\n\nWhen cleanup runs with softirqs enabled, a receive softirq for another\nconnection on the same CPU can interrupt the erase and spin on the lock\nheld by the interrupted task. Use xa_erase_bh() at both sites to match\nthe insertion path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c"], "versions": [{"version": "b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78", "lessThan": "2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "bafe51bb145e6ae549ae79dcbc35648292625934", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "0c5063a898813a420e6bad93debd134ef8b3bfd1", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "8739f06e3f82cd715f7dd10ab24029ed881efc90", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "bcf97573d44e277b1744d7f1226f665aa0ccc599", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "7110c7f70c59eb7924e79853bcc00e2a026662e6", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "bea736a2b8c6da5b1078badf1206541b5404250f", "status": "affected", "versionType": "git"}, {"version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "lessThan": "4c9dc0faca98084922caeb689579d338cf3e1c29", "status": "affected", "versionType": "git"}, {"version": "70c4ead897211b184f36cbeda213f2a3e8153218", "status": "affected", "versionType": "git"}, {"version": "5.10.42", "lessThan": "5.10.273", "status": "affected", "versionType": "semver"}, {"version": "5.12.9", "lessThan": "5.13", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.42", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe"}, {"url": "https://git.kernel.org/stable/c/bafe51bb145e6ae549ae79dcbc35648292625934"}, {"url": "https://git.kernel.org/stable/c/0c5063a898813a420e6bad93debd134ef8b3bfd1"}, {"url": "https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90"}, {"url": "https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599"}, {"url": "https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6"}, {"url": "https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f"}, {"url": "https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29"}], "title": "cxgb4/ch_ktls: disable softirqs around tid_list erases", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe", "status": "affected", "version": "b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78", "versionType": "git"}, {"lessThan": "bafe51bb145e6ae549ae79dcbc35648292625934", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "0c5063a898813a420e6bad93debd134ef8b3bfd1", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "8739f06e3f82cd715f7dd10ab24029ed881efc90", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "bcf97573d44e277b1744d7f1226f665aa0ccc599", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "7110c7f70c59eb7924e79853bcc00e2a026662e6", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "bea736a2b8c6da5b1078badf1206541b5404250f", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"lessThan": "4c9dc0faca98084922caeb689579d338cf3e1c29", "status": "affected", "version": "65e302a9bd57b62872040d57eea1201562a7cbb2", "versionType": "git"}, {"status": "affected", "version": "70c4ead897211b184f36cbeda213f2a3e8153218", "versionType": "git"}, {"lessThan": "5.10.273", "status": "affected", "version": "5.10.42", "versionType": "semver"}, {"lessThan": "5.13", "status": "affected", "version": "5.12.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxgb4/ch_ktls: disable softirqs around tid_list erases\n\nchcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path\nusing xa_insert_bh(). The array is shared by the adapter's connections\nand initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and\nthe chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray\nlock without disabling softirqs.\n\nWhen cleanup runs with softirqs enabled, a receive softirq for another\nconnection on the same CPU can interrupt the erase and spin on the lock\nheld by the interrupted task. Use xa_erase_bh() at both sites to match\nthe insertion path."}], "id": "CVE-2026-98967", "lastModified": "2026-10-30T13:21:33.090", "metrics": {}, "published": "2026-10-23T13:17:18.187", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c5063a898813a420e6bad93debd134ef8b3bfd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c49ea1dd16d6dc0dd895e6aec57c9a448191cfe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bafe51bb145e6ae549ae79dcbc35648292625934"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: cxgb4/ch_ktls: disable softirqs around tid_list erases", "id": "2559745", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559745"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncxgb4/ch_ktls: disable softirqs around tid_list erases\nchcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path\nusing xa_insert_bh(). The array is shared by the adapter's connections\nand initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and\nthe chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray\nlock without disabling softirqs.\nWhen cleanup runs with softirqs enabled, a receive softirq for another\nconnection on the same CPU can interrupt the erase and spin on the lock\nheld by the interrupted task. Use xa_erase_bh() at both sites to match\nthe insertion path.", "A flaw was found in the Linux kernel's cxgb4 network driver. During connection cleanup or error handling, the driver removes entries from an internal tracking table without disabling software interrupts. If concurrent network traffic triggers an interrupt on the same processor core during this cleanup, it can attempt to acquire the lock held by the interrupted process, causing a deadlock. This issue leads to a kernel hang, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98967", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98967\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98967\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98967.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,8739f06e3f82cd715f7dd10ab24029ed881efc90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,bcf97573d44e277b1744d7f1226f665aa0ccc599)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,7110c7f70c59eb7924e79853bcc00e2a026662e6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,bea736a2b8c6da5b1078badf1206541b5404250f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,4c9dc0faca98084922caeb689579d338cf3e1c29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "70c4ead897211b184f36cbeda213f2a3e8153218"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.42,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.12.9,5.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,8739f06e3f82cd715f7dd10ab24029ed881efc90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,bcf97573d44e277b1744d7f1226f665aa0ccc599)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,7110c7f70c59eb7924e79853bcc00e2a026662e6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,bea736a2b8c6da5b1078badf1206541b5404250f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65e302a9bd57b62872040d57eea1201562a7cbb2,4c9dc0faca98084922caeb689579d338cf3e1c29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "70c4ead897211b184f36cbeda213f2a3e8153218"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.42,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.12.9,5.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:15:07.226048+00:00", "updated": "2026-10-29T14:30:16.103813+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}