---
id: CVE-2026-98617
title: >-
  kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector
  (CVE-2026-98617)
summary: >-
  A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic)
  driver. The driver incorrectly associates receive queues with network
  processing vectors and fails to verify whether the datapath is active before
  allocating queue …
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= da43127a8edc7498cce7b2554533f4027c618933 <
    1fb569cf3bf97e552f465b2c719e36b48ae7c18b
  - >-
    Linux >= da43127a8edc7498cce7b2554533f4027c618933 <
    b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e
  - Linux 6.18
published: '2026-10-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:02:21+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98617'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555013'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98617'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98617'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98617.mbox
  - url: 'https://git.kernel.org/stable/c/1fb569cf3bf97e552f465b2c719e36b48ae7c18b'
  - url: 'https://git.kernel.org/stable/c/b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00189
epssPercentile: 0.08506
ingestedAt: '2026-10-18T15:45:12.240Z'
---

## Overview

A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue memory. A privileged local user could trigger this flaw during network queue reconfiguration or device recovery operations, causing the system to access previously freed memory and leading to a Denial of Service (DoS) via a kernel crash.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98617.json)

**kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-21.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.