CVE-2026-98615

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a Linux network driver can stop the hardware from finishing its internal cleanup, leaving the network card stuck until the computer is restarted.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Moderate
Impact: Denial Of Service
Component: OS kernel
Class: Race Condition
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The fbnic mailbox teardown writes AW_CFG with only FLUSH asserted while clearing BME, leaving staged TLP writes parked in the PUL pipeline so the flush never completes and the ring cannot be safely torn down.

Why it matters to the business

Network interface reset or driver unload on affected systems may hang indefinitely, causing loss of network connectivity until the host is rebooted.

How an attack unfolds

An attacker with the ability to trigger repeated mailbox ring teardown (via interface down/up, driver reload, or firmware interaction) can stall the write pipeline, preventing completion of the flush and leaving the device in a non-operational state.

How to fix it

Update to a Linux kernel containing the fix that defines AW_FLUSH_MODE and sets both FLUSH and FLUSH_MODE bits during ring teardown; rebuild and deploy the updated kernel or driver module on all affected hosts.

How to confirm the fix worked

Confirm the presence of the AW_FLUSH_MODE constant and the paired bit set in fbnic_mbx_reset_desc_ring; exercise interface down/up or rmmod/insmod cycles and verify that ring teardown completes without hanging.

Typical attack path

Obtain local or remote ability to administratively toggle the fbnic interface or reload the driver
Trigger fbnic_mbx_reset_desc_ring which performs the defective AW_CFG write
Observe the firmware wait on the incomplete flush, resulting in a hung reset path
Repeat to sustain denial of service on the network device

How to detect it

Review kernel logs for fbnic mailbox reset timeouts or stalled descriptor ring teardown; inspect dmesg or journalctl output around interface events for incomplete flush indicators.

What your security team should do

Prioritize kernel update on any system using the fbnic driver within the next maintenance window
Add the driver to the inventory of network drivers requiring expedited patching
Monitor for upstream stable-kernel backports of the mailbox flush change

The record

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnic_mbx_reset_desc_ring() writes AW_CFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts the device's writes to the host but leaves the staged requests parked in the PUL write pipeline rather than draining them, so on the write path FLUSH alone never terminates the outstanding requests and the flush the firmware waits on never completes. Add the FLUSH_MODE definition and set both bits so the staged writes drain out of the pipeline on their own. BME stays cleared, so nothing lands on the host; it is restored later in fbnic_mbx_init_desc_ring() when the ring is rebuilt, once the outstanding writes are gone. The read path is unaffected. AR_CFG has no equivalent mode bit and AR_FLUSH terminates the outstanding reads by itself, so it is left as is. Both writes remain plain stores rather than read-modify-writes. That is deliberate: the matching write in fbnic_mbx_init_desc_ring() restores BME and the TLP attributes, and clears both flush bits as a side effect.

Affected packages

Ecosystem	Package	Introduced	Fixed