CVE-2026-98967

cxgb4/ch_ktls: disable softirqs around tid_list erases

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cxgb4/ch_ktls: disable softirqs around tid_list erases

chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs.

When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78 to before 2c49ea1dd16d6dc0dd895e6aec57c9a448191cfeAffected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before bafe51bb145e6ae549ae79dcbc35648292625934Affected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before 0c5063a898813a420e6bad93debd134ef8b3bfd1Affected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before 8739f06e3f82cd715f7dd10ab24029ed881efc90Affected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before bcf97573d44e277b1744d7f1226f665aa0ccc599Affected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before 7110c7f70c59eb7924e79853bcc00e2a026662e6Affected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before bea736a2b8c6da5b1078badf1206541b5404250fAffected 65e302a9bd57b62872040d57eea1201562a7cbb2 to before 4c9dc0faca98084922caeb689579d338cf3e1c29Affected 70c4ead897211b184f36cbeda213f2a3e8153218Affected 5.10.42 to before 5.10.273Affected 5.12.9 to before 5.13Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78 to before 2c49ea1dd16d6dc0dd895e6aec57c9a448191cfeAffected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before bafe51bb145e6ae549ae79dcbc35648292625934Affected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before 0c5063a898813a420e6bad93debd134ef8b3bfd1Affected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before 8739f06e3f82cd715f7dd10ab24029ed881efc90Affected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before bcf97573d44e277b1744d7f1226f665aa0ccc599Affected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before 7110c7f70c59eb7924e79853bcc00e2a026662e6Affected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before bea736a2b8c6da5b1078badf1206541b5404250fAffected
65e302a9bd57b62872040d57eea1201562a7cbb2 to before 4c9dc0faca98084922caeb689579d338cf3e1c29Affected
70c4ead897211b184f36cbeda213f2a3e8153218Affected
5.10.42 to before 5.10.273Affected
5.12.9 to before 5.13Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.