Cloudanix VulnDB

CVE-2026-98909

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A network driver inside Linux can forget to clean up some internal bookkeeping when a startup step fails, which may leave small amounts of tracking data behind and cause occasional network problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The cpsw_probe function registers a devlink instance before attempting CPSW port registration; on failure of cpsw_register_ports the error path omits the corresponding devlink unregister, leaving the devlink object and its parameters registered after the probe has failed.

Why it matters to the business

Systems using the affected network hardware may experience resource leaks or inconsistent driver state on probe failures, potentially leading to degraded network functionality or the need for reboots in production environments.

How an attack unfolds

An attacker or misbehaving environment triggers a port-registration failure after devlink registration succeeds, leaving a stale devlink instance that may be abused to read or manipulate driver parameters outside normal lifecycle expectations.

How to fix it

Apply the upstream kernel patch that adds a devlink cleanup label and invokes it on port-registration failure; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Inspect the cpsw_new probe error paths in the running kernel source or binary to confirm the devlink unregister call exists; attempt to induce port-registration failure and verify no stale devlink instance remains.

Typical attack path

  1. Identify hosts running the vulnerable cpsw_new driver
  2. Cause or wait for cpsw_register_ports to fail after devlink registration
  3. Interact with the leaked devlink instance to read or alter parameters
  4. Leverage resulting inconsistent state for denial-of-service or information disclosure

How to detect it

Search kernel logs and dmesg for cpsw_probe error paths that mention devlink registration without subsequent unregistration; examine devlink listings for unexpected CPSW instances after driver load failures.

What your security team should do

  • Prioritize kernel updates on any system exposing the cpsw_new driver
  • Add kernel log monitoring for cpsw_probe failures
  • Review device trees and hardware configurations that may trigger port-registration errors
  • Test the patched kernel in a lab environment before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed. Add a devlink cleanup label for the path where devlink registration has already succeeded, and use it when port registration fails.

Affected packages

Ecosystem Package Introduced Fixed