# CVE-2026-98616: eth: fbnic: reset num_napi when the napi vectors are freed

CVE-2026-98616 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98616 (version 7.2.9-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98616
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98616

## Description

In the Linux kernel, the following vulnerability has been resolved:  eth: fbnic: reset num_napi when the napi vectors are freed  fbn->num_napi is the count of live napi vectors, each of which owns an IRQ.  The PM path had freed them without clearing the count. fbnic_pm_suspend() tears the datapath down via ndo_stop() and frees the IRQs, but leaves netif_running() true so resume knows to re-open.  Resume rebuilds the datapath in __fbnic_pm_resume() and fbnic_reset_queues() sets num_napi and __fbnic_open() re-allocates the vectors.  When the datapath is torn down but never rebuilt, num_napi is left pointing at freed vectors under 2 different scenarios:  - a PCIe error recovery that fails (fbnic_err_slot_reset() ->    __fbnic_pm_resume() returns an error -> PCI_ERS_RESULT_DISCONNECT), so    .resume never runs; or  - an __fbnic_open() that fails partway on resume and unwinds, freeing    the vectors after fbnic_reset_queues() has already set num_napi.  The netdev is then running with num_napi > 0 but napi[] freed, and the eventual remove/unbind close re-enters fbnic_down() -> fbnic_dbg_down() and dereferences the freed vectors:   BUG: kernel NULL pointer dereference, address: 0000000000000210   RIP: fbnic_dbg_down+0x28  Clear num_napi when the vectors are freed: in the suspend teardown (a good resume re-establishes it before __fbnic_open()) and on the resume open failure.  A redundant ndo_stop() then walks an empty napi[].  The normal ndo_stop() down/up cycle is untouched and keeps num_napi for the next ndo_open().

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.9-1 | [DEBIAN-CVE-2026-98616](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98616.md) | Oct 19, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.