# CVE-2026-90098: net: sparx5: fix sleep in atomic context in MAC table access

CVE-2026-90098 is fixed in linux on 1 platform by DEBIAN-CVE-2026-90098 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-90098
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 17, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90098

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: sparx5: fix sleep in atomic context in MAC table access  sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc via __dev_mc_sync(), which per address calls sparx5_mc_sync() / sparx5_mc_unsync() -> sparx5_mact_learn() / sparx5_mact_forget().  These take sparx5->lock, a mutex, and then poll the MAC access command register with readx_poll_timeout(). A mutex may block, which is not allowed from atomic context.  Convert the driver to the new .ndo_set_rx_mode_async callback introduced in commit 3554b4345d85 ("net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work"). The async callback is invoked from process context, so the mutex and sleeping completion poll can remain.  Observed with CONFIG_PROVE_LOCKING, CONFIG_DEBUG_SPINLOCK, CONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_ATOMIC_SLEEP enabled:    BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 217, name: ip   preempt_count: 201, expected: 0   Call trace:    __might_resched+0x144/0x248    __might_sleep+0x48/0x7c    __mutex_lock+0x74/0x850    mutex_lock_nested+0x24/0x30    sparx5_mact_learn+0x78/0x100    sparx5_mc_sync+0x40/0x54    __hw_addr_sync_dev+0xc4/0x170    sparx5_set_rx_mode+0x4c/0x58    __dev_set_rx_mode+0x64/0xa4    __dev_open+0x1ec/0x26c

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-90098](https://patchblox.com/security/data/fix/linux/debian-cve-2026-90098.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.