Cloudanix VulnDB

CVE-2026-98967

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small locking mistake in the Linux network driver for certain Chelsio cards could cause the system to freeze when handling encrypted connections under load.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in cxgb4/ch_ktls tid_list handling where xa_erase() is called without disabling softirqs, allowing receive softirqs to interrupt and spin on the XArray lock held by the interrupted context.

Why it matters to the business

Potential kernel hangs or degraded network performance on systems using Chelsio T4/T5/T6 adapters with kTLS, increasing operational risk for high-throughput or latency-sensitive workloads until patched.

How an attack unfolds

An attacker with local access triggers concurrent chcr_ktls_dev_del or error paths alongside receive processing on the same CPU, causing the softirq to contend on the improperly acquired XArray lock and stall the adapter connection cleanup.

How to fix it

Update to a Linux kernel containing the fix that replaces xa_erase() with xa_erase_bh() in chcr_ktls_dev_del and the chcr_ktls_dev_add error path.

How to confirm the fix worked

Confirm the presence of xa_erase_bh() calls in the cxgb4 ch_ktls source for the affected functions and verify no xa_erase() remains in those code paths after applying the update.

Typical attack path

  1. Gain local execution on a Linux host with cxgb4 and kTLS enabled
  2. Trigger kTLS connection setup and teardown paths while network receive traffic is active on the same CPU
  3. Induce the xa_erase path without BH disabled to contend on the XArray lock
  4. Observe softirq spinlock contention leading to system stall or watchdog timeout

How to detect it

Search kernel logs for softirq spinlock contention warnings, watchdog timeouts, or cxgb4 adapter reset events coinciding with kTLS connection teardown; inspect for repeated xa_erase calls without BH context in stack traces.

What your security team should do

  • Prioritize kernel updates for systems with Chelsio cxgb4 adapters and kTLS enabled within the next maintenance window
  • Monitor for softirq-related stalls or adapter reset events on affected hardware
  • Review kTLS usage in production workloads and consider disabling if updates cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs. When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.

Affected packages

Ecosystem Package Introduced Fixed