VulnerabilityPublished 18 Oct 2026

CVE-2026-98617: Linux kernel · eth: fbnic: use the Rx queue napi pointer to find the napi vector

Source GCVE Database

Authoritative record:CVE-2026-98617· Medium

Not known to be exploited : upgrade to b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e or 1fb569cf3bf97e552f465b2c719e36b48ae7c18b when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e, 1fb569cf3bf97e552f465b2c719e36b48ae7c18b

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-j327-5j79-p464

What to do

Upgrade Linux kernel to b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e or 1fb569cf3bf97e552f465b2c719e36b48ae7c18b.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ da43127a8edc7498cce7b2554533f4027c618933, < b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e	Fixed in b5d9e9d4d0c13bc8b60d8d97e7a07fb25fea639e
LinuxLinux	Affected ≥ da43127a8edc7498cce7b2554533f4027c618933, < 1fb569cf3bf97e552f465b2c719e36b48ae7c18b	Fixed in 1fb569cf3bf97e552f465b2c719e36b48ae7c18b
LinuxLinux	Affected =6.18	Fixed in–
Debiandebian/linux`pkg:deb/debian/linux`Other threats	Affected =6.18	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix has been implemented in the Linux kernel to correct the NAPI vector mapping in the fbnic driver. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are indicated or required based on the vendor advisory.

Description

A vulnerability in the Linux kernel's fbnic Ethernet driver related to incorrect usage of the Rx queue NAPI pointer has been resolved. The issue involved the queue management code incorrectly mapping Rx queues to Tx NAPI vectors when standalone Tx vectors were present, potentially causing use of freed memory or invalid pointers during queue restart or PCIe recovery scenarios. The fix uses the correct napi pointer stored in netdev_rx_queue.napi, ensuring safe queue management under locking. No CVSS score is available for this issue.

References

Community reviews

Loading reviews…