CVE-2026-97434 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: fix handling of NAPI on the remove path
All the NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. The NAPI instances get disabled only once the last port goes down.
This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled.
In order to avoid this, split up the unregister_netdev() calls from the free_netdev() so that we make sure all ports go down before we attempt a deletion of NAPI instances. Also, make the netif_napi_del() explicit as it is on the .probe() path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified in the dpaa2-switch driver involves a critical resource management flaw within the Network API (NAPI) subsystem during device removal operations. The underlying architecture of the Data Path Switching Interface version 2 switch utilizes NAPI instances that are attached to the net_device structure of the first switch port but are shared across all ports associated with the DPSW device. This design choice implies a dependency where the lifecycle of these NAPI instances is tied not to individual port states, but rather to the collective state of all connected ports. Specifically, the NAPI instances remain active and enabled as long as at least one port remains operational, ensuring that packet processing capabilities are preserved for any active interface within the switch fabric.
The technical flaw manifests during the device removal phase, specifically in the .remove() callback function responsible for cleaning up driver resources when a PCIe or similar bus device is detached from the system. The original implementation iterates through each port to unregister and free its associated net_device structures sequentially. Because the unregistration process triggers state changes that may inadvertently signal the end of activity for specific ports, the kernel's internal logic incorrectly determines that all ports are down even though only one or a subset have been processed at any given time. Consequently, this premature determination leads to the deletion of NAPI instances via netif_napi_del() while they are still technically enabled and potentially in use by other active ports within the same device group.
This improper handling results in several severe operational impacts ranging from kernel instability to security risks. The most immediate consequence is a potential Use-After-Free condition, where memory associated with NAPI structures is freed while pointers to them may still be referenced by interrupt handlers or softirq contexts that have not yet completed their execution cycles. This can lead to system crashes, denials of service through kernel panics, or data corruption within the network stack. Furthermore, such race conditions and invalid memory accesses create exploitable vectors for local privilege escalation if an attacker can trigger device removal events under specific timing constraints, thereby violating the integrity and availability principles central to cybersecurity frameworks like CWE-416 (Use After Free) and CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization).
To mitigate this vulnerability, the fix involves restructuring the cleanup sequence in the driver's remove path. The primary corrective action is to decouple the unregister_netdev() calls from the free_netdev() operations. By ensuring that all ports are fully unregistered and brought down before any attempt is made to delete NAPI instances, the driver guarantees that no active references remain when resources are reclaimed. Additionally, the implementation makes the invocation of netif_napi_del explicit during this phase, mirroring the logic used in the probe path where device initialization occurs. This alignment ensures consistent state management and prevents premature resource deallocation. System administrators should apply kernel updates containing this patch to maintain system stability and prevent potential exploitation of these race conditions in production environments running affected versions of the Linux kernel with dpaa2-switch support enabled.