{
  "cveId": "CVE-2026-98616",
  "url": "https://patchblox.com/security/cve/CVE-2026-98616",
  "summary": "CVE-2026-98616 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98616 (version 7.2.9-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "eth: fbnic: reset num_napi when the napi vectors are freed",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  eth: fbnic: reset num_napi when the napi vectors are freed  fbn-\u003Enum_napi is the count of live napi vectors, each of which owns an IRQ.  The PM path had freed them without clearing the count. fbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the IRQs, but leaves netif_running() true so resume knows to re-open.  Resume rebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets num_napi and __fbnic_open() re-allocates the vectors.  When the datapath is torn down but never rebuilt, num_napi is left pointing at freed vectors under 2 different scenarios:  - a PCIe error recovery that fails (fbnic_err_slot_reset() -\u003E    __fbnic_pm_resume() returns an error -\u003E PCI_ERS_RESULT_DISCONNECT), so    .resume never runs; or  - an __fbnic_open() that fails partway on resume and unwinds, freeing    the vectors after fbnic_reset_queues() has already set num_napi.  The netdev is then running with num_napi \u003E 0 but napi[] freed, and the eventual remove/unbind close re-enters fbnic_down() -\u003E fbnic_dbg_down() and dereferences the freed vectors:   BUG: kernel NULL pointer dereference, address: 0000000000000210   RIP: fbnic_dbg_down\u002B0x28  Clear num_napi when the vectors are freed: in the suspend teardown (a good resume re-establishes it before __fbnic_open()) and on the resume open failure.  A redundant ndo_stop() then walks an empty napi[].  The normal ndo_stop() down/up cycle is untouched and keeps num_napi for the next ndo_open().",
  "published": "2026-10-18T16:17:14Z",
  "severity": "",
  "epss": 0.00166,
  "epssPercentile": 0.05857,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98616",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.9-1",
      "fix": "DEBIAN-CVE-2026-98616",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98616",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}