CVE-2026-72409 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: mvneta: re-enable percpu interrupt on resume
On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules NAPI poll, which calls enable_percpu_irq() on completion to unmask.
If suspend occurs while NAPI poll is pending (between disable_percpu_irq in the ISR and enable_percpu_irq in poll completion), the interrupt is never re-enabled:
1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule() => MPIC masked, percpu_enabled cpumask bit cleared 2. NAPI poll does not complete before suspend proceeds (on PREEMPT_RT this is highly likely since softirqs run in ksoftirqd which gets frozen; on non-RT it can happen when softirq processing is deferred to ksoftirqd) 3. mvneta_stop_dev => napi_disable(): cancels the pending poll without executing the completion path 4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC (already masked, but records IRQS_SUSPENDED) 5. Resume: mpic_resume checks irq_percpu_is_enabled() => false (bit was cleared in step 1) => skips unmask 6. mvneta_start_dev only restores device-level INTR_NEW_MASK, does not touch the MPIC per-CPU mask
Result: MPIC per-CPU interrupt stays masked permanently. The NIC generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never receives them, causing complete loss of network connectivity.
Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt regardless of pre-suspend state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability affects Marvell MPIC platforms running the Linux kernel, specifically targeting Armada 370/XP/38x SoC architectures where network connectivity can be permanently compromised due to improper interrupt handling during system suspend-resume cycles. The issue stems from a race condition in the mvneta network driver's interrupt management mechanism that fails to properly restore percpu interrupt states after system resume operations. The vulnerability represents a critical failure in interrupt state persistence that directly impacts network functionality and system availability.
The technical flaw manifests through a complex interaction between multiple kernel subsystems including the networking layer, interrupt handling framework, and power management components. During normal operation, the mvneta driver employs a percpu interrupt disable/enable scheme where the ISR (mvneta_percpu_isr) calls disable_percpu_irq() to mask interrupts and schedules NAPI polling operations that eventually call enable_percpu_irq() to restore interrupt functionality upon completion. This mechanism works correctly under normal conditions but fails when system suspend occurs while a NAPI poll operation is pending, creating a state where interrupts remain masked indefinitely.
The operational impact of this vulnerability is severe as it results in complete network connectivity loss that persists across system resume cycles. When the system enters suspend mode while a NAPI poll is pending between disable_percpu_irq() and enable_percpu_irq() completion, the interrupt masking state becomes inconsistent. The subsequent suspend_device_irqs operation records the IRQS_SUSPENDED flag but does not properly handle the percpu interrupt state that was cleared during the ISR execution. During resume, the mpic_resume function checks irq_percpu_is_enabled() which returns false because the cpumask bit was cleared in step one, causing the system to skip the unmasking operation entirely.
The root cause can be mapped to CWE-691, which addresses insufficient control of a resource through a mechanism that allows access to an unauthorized user or process. This vulnerability also aligns with ATT&CK technique T1547.001 related to registry run keys and persistence mechanisms, though more specifically represents a system-level interrupt management failure rather than a persistence vector. The fix implemented involves calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally restore percpu interrupt masking states regardless of their pre-suspend configuration, ensuring that all CPU cores have their interrupts properly re-enabled.
This vulnerability demonstrates the complexity of managing interrupt states across multiple kernel subsystems during power management operations and highlights the importance of proper state preservation during suspend-resume cycles. The issue is particularly prevalent on PREEMPT_RT systems where softirq processing occurs in frozen ksoftirqd threads, making the race condition more likely to occur. The fix addresses the core problem by ensuring interrupt state consistency regardless of when suspend operations occur relative to pending network operations, thereby restoring proper network functionality after system resume without requiring manual intervention or reboot cycles.