CVE-2026-90084 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-vf: fix workqueue and netdev race in probe/remove
Initialize the VF workqueue before register_netdev() so ndo_set_rx_mode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add proper probe error cleanup.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified within the octeontx2-vf network driver addresses a critical race condition occurring during device initialization and removal phases. This issue stems from an incorrect ordering of resource allocation and registration steps in the probe function, specifically concerning the relationship between the virtual function workqueue and the network device structure. In standard Linux kernel networking drivers, the net_device_operations structure includes callbacks such as ndo_set_rx_mode which are invoked by the core networking subsystem when interface state changes occur. If these operations trigger asynchronous tasks that rely on a driver-specific workqueue, it is imperative that this workqueue be fully initialized and ready to accept queued items before any part of the network device becomes active or visible to the kernel stack.
The root cause of this vulnerability lies in the sequence where register_netdev was called prior to initializing the VF workqueue. Consequently, if ndo_set_rx_mode were invoked during or immediately after registration, it would attempt to queue a work item onto a NULL pointer representing an uninitialized workqueue. This scenario leads directly to a kernel panic due to a null pointer dereference, effectively causing a denial of service for the system hosting the affected driver. Such race conditions are particularly dangerous because they may not manifest under all load conditions or hardware configurations, making them difficult to reproduce in controlled testing environments without specific timing triggers.
From an architectural perspective, this flaw represents a classic initialization ordering error where dependent resources are accessed before their prerequisites are established. The operational impact is severe as it allows for local denial of service attacks if an attacker can trigger network mode changes during the brief window between device registration and workqueue setup. Furthermore, improper cleanup sequences in the remove path exacerbate stability issues by potentially accessing freed memory or leaving dangling pointers to destroyed resources. This violates fundamental principles of resource management where allocation must precede usage and deallocation must follow unregistration to ensure no active references remain.
This vulnerability aligns with CWE-362 which describes concurrent execution race conditions, specifically those arising from improper synchronization during initialization sequences. It also relates to CWE-415 concerning double free or use-after-free scenarios if the removal path fails to properly synchronize resource destruction with device unregistration. In terms of attack vectors, this falls under ATT&CK technique T1079 which involves system service discovery and manipulation, although in this specific context it is more accurately categorized as a reliability flaw exploitable for local denial of service rather than privilege escalation or data exfiltration.
To mitigate these risks, the fix implements strict ordering constraints ensuring that the VF workqueue is initialized before register_netdev is called. This guarantees that any asynchronous operations triggered by network subsystem callbacks have valid targets. Additionally, the removal process has been restructured to unregister the net device first and only then destroy the associated workqueue. This ensures that no pending or in-flight tasks reference resources after they have been freed. Proper error handling paths during probe are also corrected to guarantee that partially initialized resources are cleaned up correctly if initialization fails midway, preventing resource leaks and maintaining system stability under failure conditions.