CVE-2026-98356 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
bnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB handler later calls queue_work() on the NULL pointer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel driver for Broadcom NetXtreme-C/E RDMA devices, specifically bnxt_re, contains a critical resource management flaw within its Data Center Bridging configuration workflow. During the initialization phase of the Data Center Bridging (DCB) subsystem, the function bnxt_re_init_dcb_wq is responsible for allocating and initializing a single-threaded workqueue to handle asynchronous DCB events. This mechanism relies on the kernel API create_singlethread_workqueue() to establish the necessary execution context for deferred processing tasks. However, the implementation fails to verify whether this allocation call succeeded or returned NULL due to memory pressure or other system constraints. By ignoring the potential failure of this critical resource acquisition, the driver proceeds with a null pointer assumption that is fundamentally unsafe and violates standard defensive programming practices required in kernel-space operations.
This oversight leads directly to a severe operational instability when the asynchronous DCB handler attempts to schedule work on the uninitialized queue. Specifically, subsequent calls to queue_work() are executed against a NULL pointer representing the target workqueue structure. In Linux kernel architecture, passing a null or invalid pointer to scheduling functions results in an immediate dereference of memory address zero or an unmapped region. This action triggers a kernel panic or a general protection fault, causing an abrupt system crash and resulting in a denial of service for all processes running on the affected host. The vulnerability effectively allows any local user with access to trigger DCB configuration changes, such as those required for high-performance networking setups, to destabilize the entire operating system without requiring elevated privileges beyond standard device interaction capabilities.
From a classification perspective, this flaw is categorized under CWE-252, which describes unchecked return values leading to improper resource handling or null pointer dereferences. The specific technical manifestation aligns with CWE-476, representing a NULL Pointer Dereference vulnerability where the software performs an operation on a data structure using a null pointer that has not been verified as non-null. In terms of adversary behavior and attack patterns defined by MITRE ATT&CK for Enterprise or ICS, this type of instability can be leveraged in Local Privilege Escalation scenarios if combined with other vulnerabilities to crash the system during security monitoring windows, thereby disrupting audit trails and availability controls. It also falls under Availability impact within the CIA triad, as it directly compromises the reliability and uptime of critical infrastructure relying on RDMA for low-latency communication.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to apply the upstream Linux kernel patches that introduce explicit null checks following every call to create_singlethread_workqueue(). If allocation fails, the driver should log an appropriate error message via printk or dev_err and abort the initialization process gracefully rather than proceeding with a broken state. System administrators running affected versions of the bnxt_re driver should ensure their kernels are updated to include these fixes. Furthermore, developers integrating similar kernel subsystems should adopt static analysis tools that detect unchecked return values from memory allocation functions and enforce strict validation protocols for all resource acquisition calls within device drivers to prevent recurrence of such null pointer dereferences in future code revisions.