# CVE-2026-97434: dpaa2-switch: fix handling of NAPI on the remove path

CVE-2026-97434 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-97434, released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-97434
- Priority: Routine
- CVSS: 4.1 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 24, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97434

## Description

In the Linux kernel, the following vulnerability has been resolved:  dpaa2-switch: fix handling of NAPI on the remove path  All the NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. The NAPI instances get disabled only once the last port goes down.  This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled.  In order to avoid this, split up the unregister_netdev() calls from the free_netdev() so that we make sure all ports go down before we attempt a deletion of NAPI instances. Also, make the netif_napi_del() explicit as it is on the .probe() path.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.190-1 | [DEBIAN-CVE-2026-97434](https://patchblox.com/security/data/fix/linux/debian-cve-2026-97434.md) | Sep 24, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.111-1 | [DEBIAN-CVE-2026-97434](https://patchblox.com/security/data/fix/linux/debian-cve-2026-97434.md) | Sep 24, 2026 |
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-97434](https://patchblox.com/security/data/fix/linux/debian-cve-2026-97434.md) | Sep 24, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.111-1~deb12u1 | [DEBIAN-CVE-2026-97434](https://patchblox.com/security/data/fix/linux/debian-cve-2026-97434.md) | Sep 24, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.