CVE-2026-98277 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: ring the doorbell if a burst ends in a drop
fbnic_tx_map() skips the doorbell write, and the completion request, for every packet handed to it with xmit_more set, counting on the packet which ends the burst to publish them all. When that packet is dropped instead - skb_put_padto(), skb_cow_head() or a DMA mapping failure - nothing rings. The descriptors of the preceding packets stay invisible to the HW until the next transmit on that queue, which for a burst-then-idle workload may never come.
Remember the meta descriptor of the last packet left without a doorbell and flush it from the error paths. The completion request has to be set on that descriptor rather than simply writing the tail, otherwise the HW would transmit the packets but never report a head, and the ring would fill up and stall for good.
This is very similar to Joe's recent series of fixes for bnxt. Not seen in real life, reproduced under QEMU with failure injection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel network driver fbnic contains a logic flaw within its transmission path that can lead to packet loss and potential queue stalls when handling bursts of outgoing traffic. The vulnerability centers on the function fbnic_tx_map(), which is responsible for mapping packets to hardware descriptors and signaling the Network Interface Card (NIC) via doorbell writes. In high-throughput scenarios, drivers often optimize performance by batching multiple packets into a single transmission burst. To achieve this efficiency, the driver delays writing the doorbell register until it determines that the current batch of packets has been fully processed or is about to be completed. This optimization relies on the assumption that at least one packet in the burst will successfully complete its mapping process and trigger the necessary hardware signals.
The specific technical flaw occurs when a packet within such a burst fails during the mapping phase due to conditions like skb_put_padto(), skb_cow_head() failures, or DMA mapping errors. In these error scenarios, the driver skips the doorbell write for that specific packet but does not retroactively signal the hardware regarding the preceding packets in the same batch. Consequently, the descriptors associated with those earlier successful mappings remain invisible to the NIC because the required completion request was never issued. The hardware waits indefinitely for a trigger that will never arrive within the context of that burst cycle.
This oversight results in significant operational impact as the network queue effectively stalls. Since the preceding packets are not acknowledged by the hardware, they cannot be transmitted or completed. For workloads characterized by bursts followed periods of idleness, this stall may persist indefinitely because no new transmit operations occur to trigger a delayed doorbell write for the stuck descriptors. This leads to unexplained packet drops and degraded network performance, potentially affecting applications dependent on low-latency or reliable data transmission over these interfaces.
The resolution involves modifying the error handling paths within fbnic_tx_map() to ensure that if any packet in a burst fails mapping, the meta descriptor of the last successfully mapped packet is explicitly flushed. Crucially, this flush must include setting the completion request bit on that descriptor rather than merely updating the tail pointer. This ensures that the hardware receives both the data and the instruction to report back upon transmission, preventing the ring buffer from filling up without progress and allowing subsequent packets to be processed normally.
From a security and standards perspective, this vulnerability aligns with CWE-841 Improper Enforcement of Behavioral Workflow, as the driver fails to enforce the correct sequence of operations when an error interrupts the expected flow. It also relates to CWE-755 Improper Handling of Unexpected State Condition, where the system does not properly handle the state resulting from a failed operation within a batched process. In terms of MITRE ATT&CK, this could be leveraged in Denial of Service scenarios by inducing repeated mapping failures to exhaust network resources or stall communication channels, although it is primarily classified as a reliability and performance issue rather than an exploitable security breach for privilege escalation. Mitigation requires applying the kernel patch that corrects the error path logic to guarantee hardware signaling even when individual packet mappings fail within a burst.