Cloudanix VulnDB

CVE-2026-98618

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a Linux network driver can cause systems to crash when handling many network queues at once.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

In the Linux kernel fbnic driver, standalone channel allocation for maximum Tx/Rx queues (64 each) undercounts NAPI vectors by half, resulting in NULL pointer entries that are dereferenced during resource setup and leading to memory corruption.

Why it matters to the business

Systems using the fbnic Ethernet driver may experience kernel crashes or instability under high queue configurations, causing denial of service and operational disruption on affected Linux hosts.

How an attack unfolds

An attacker with local or network access configures a fbnic interface for maximum standalone channels (64 Tx/64 Rx), triggering the allocation mismatch; subsequent driver initialization dereferences the NULL vectors, crashing the kernel.

How to fix it

Apply the upstream kernel fix that includes the maximum vector count in standalone allocation for fbnic; update to a patched kernel version and rebuild modules if necessary.

How to confirm the fix worked

Verify the patch is present by inspecting the fbnic allocation code for the corrected vector count; test with a 64/64 standalone configuration and confirm no NULL dereferences occur during initialization.

Typical attack path

  1. Identify systems running the fbnic driver
  2. Configure the interface for 64-Tx/64-Rx standalone channels
  3. Trigger resource setup path in the driver
  4. Induce NULL dereference leading to kernel panic

How to detect it

Search kernel logs and crash dumps for fbnic NULL pointer dereference messages or allocation failures involving NAPI vectors during driver initialization.

What your security team should do

  • Prioritize kernel updates on all systems using fbnic
  • Monitor kernel logs for fbnic-related NULL pointer dereference panics
  • Limit queue configurations to non-maximum standalone mode until patched
  • Audit for fbnic driver usage across the environment

The record

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128 vectors but allocates only 64, leaving NULL entries that resource setup dereferences. Include the maximum vector count in standalone allocation.

Affected packages

Ecosystem Package Introduced Fixed