CVE-2026-98050: Software Security Vulnerability Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g63f-gg2v-x4xj",
  "modified" : "2026-09-25T15:31:44Z",
  "published" : "2026-09-25T12:31:34Z",
  "aliases" : [ "CVE-2026-98050" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context\n\nCurrently mlxsw_sp1_ptp_ht_gc_collect() is run from the PTP\ngarbage-collection workqueue, rather than the NAPI poll context. For any\nunmatched PTP entries carrying an SKB, it calls\nmlxsw_sp1_ptp_unmatched_finish() -> mlxsw_sp1_ptp_packet_finish(). For\ningress packets, this calls mlxsw_sp_rx_listener_no_mark_func(). The end\nof that function is the following:\n\n    skb->protocol = eth_type_trans(skb, skb->dev);\n    napi_gro_receive(mlxsw_skb_cb(skb)->rx_md_info.napi, skb);\n\nThe napi pointer is one that was placed in the SKB control block when the\ntrapped packet was received in the NAPI context. Later, when the GC reaps\nthe unmatched entry (up to MLXSW_SP1_PTP_HT_GC_TIMEOUT later), the call to\nnapi_gro_receive() mutates the NAPI instance's GRO list, which is unsafe\nif the poll is running concurrently on another CPU.\n\nIn mlxsw_sp1_ptp_ht_gc_collect(), local_bh_disable() is called to prevent\nsoftirq processing, but this only applies to the local CPU. Additionally,\nits comment is stale. It states that mlxsw_sp1_ptp_unmatched_finish()\ninvokes netif_receive_skb(). This has not been accurate since the\nreferenced commit; this patch makes that comment accurate again.\nmlxsw_pci_napi_devs_init() calls netif_threaded_enable() on the NAPI RX\nnet_device without any conditions. The NAPI instance's poll, which may be\nrunning concurrent to the GC, is running as an independently-scheduled\nkthread which may be on a different CPU. The call to local_bh_disable()\ndoes not guard against this.\n\nIf a tx-timestamp timeout produces an unmatched entry (which can be easily\nreproduced by running ptp4l and waiting for a port to reach the\nUNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of\na poll on another CPU, both sides mutate the GRO list concurrently, as\nshown below:\n\n  [39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS_SLAVE\n  list_add corruption. next->prev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw_rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy)\n  Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018\n  RIP: 0010:__list_add_valid_or_report+0x79/0xb0\n  RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246\n  RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540\n  RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff\n  R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003\n  R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001\n  FS:  0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0\n  Call Trace:\n  <TASK>\n  gro_receive_skb+0xee/0x230\n  mlxsw_sp1_ptp_got_packet+0x61/0x140 [mlxsw_spectrum]\n  mlxsw_core_skb_receive+0xdf/0x1b0 [mlxsw_core]\n  mlxsw_pci_napi_poll_cq_rx+0x780/0x9d0 [mlxsw_pci]\n  __napi_poll+0x31/0x1e0\n  napi_threaded_poll_loop+0x16b/0x1c0\n  napi_threaded_poll+0x71/0xa0\n  kthread+0xfb/0x260\n  ret_from_fork+0x22d/0x260\n  ret_from_fork_asm+0x1a/0x30\n  </TASK>\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe machinery that leads to this kernel panic has not been changed between\n6.18.48 and mainline.\n\nThis patch adds an ingress-delivery helper for the PTP packet_finish()\npath that calls netif_receive_skb() instead of napi_gro_receive().\nnetif_receive_skb(), unlike napi_gro_receive(), can be called from outside\nof the NAPI instance's poll context, which can occur at the call site for\nthis path. RX stats accounting and the skb->dev assignment are still\npreserved; the only change is the delivery call itself.\n\nThis removes GR\n---truncated---",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98050"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2ac174dfcdde399fa95ba889541fb5e688d8bb35"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4375b3d1c2898886df1f908160c7004bdd938e73"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7ddcc460176eb34f9bc5bda3cc274d0d24dc62a9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-362" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-25T11:17:33Z"
  }
}