{"id":"CVE-2026-98617","title":"kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)","summary":"A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Linux","affected":["Linux >= da43127a8edc7498cce7b2554533f4027c618933 < 1fb569cf3bf97e552f465b2c719e36b48ae7c18b","Linux >= da43127a8edc7498cce7b2554533f4027c618933 < b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e","Linux 6.18"],"published":"2026-10-18","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:02:21+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98617"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555013"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98617"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98617"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98617.mbox"},{"url":"https://git.kernel.org/stable/c/1fb569cf3bf97e552f465b2c719e36b48ae7c18b"},{"url":"https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00189,"epssPercentile":0.08506,"ingestedAt":"2026-10-18T15:45:12.240Z","slug":"CVE-2026-98617","body":"## Overview\n\nA flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue memory. A privileged local user could trigger this flaw during network queue reconfiguration or device recovery operations, causing the system to access previously freed memory and leading to a Denial of Service (DoS) via a kernel crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json)\n\n**kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-21.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":226988,"id":"CVE-2026-98617","ts":1792584970317,"field":"cvss","old":null,"new":"4.1"},{"seq":226987,"id":"CVE-2026-98617","ts":1792584970317,"field":"severity","old":"none","new":"medium"}]}