In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases… (CVE-2026-98967)

The Linux kernel vulnerability CVE-2026-98967 affects the cxgb4 driver, specifically the ch_ktls component. The function chcr_ktls_cpl_act_open_rpl() inserts entries into a shared tid_list array using xa_insert_bh(), which disables softirqs to protect the lock. However, the cleanup functions chcr_ktls_dev_del() and the error path of chcr_ktls_dev_add() use xa_erase() without disabling softirqs. This mismatch can cause a receive softirq on the same CPU to interrupt the erase operation and spin on the lock held by the interrupted task, leading to potential deadlock. The resolution is to replace xa_erase() with xa_erase_bh() to disable softirqs consistently, matching the insertion path and preventing lock contention.

The vulnerability can cause a spinlock deadlock in the kernel due to improper synchronization when modifying the tid_list array under softirq context. This can lead to kernel hangs or degraded system responsiveness on affected systems using the cxgb4 driver with ch_ktls enabled.

A fix is available that replaces xa_erase() calls with xa_erase_bh() to properly disable softirqs during tid_list erases. Users should apply the official Linux kernel updates that include this patch. No alternative mitigations are indicated.