In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in… (CVE-2026-98911)

The Linux kernel vulnerability CVE-2026-98911 concerns the dpaa2-switch driver's error path in the dpaa2_switch_rx() function. When an error occurs, dpaa2_switch_free_fd() was called to free the frame descriptor (FD), but this function is intended only for Tx frame descriptors that have a valid skb pointer for dev_kfree_skb(). Using it incorrectly on Rx descriptors can cause improper memory handling. The fix extracts dma_unmap_page() from dpaa2_switch_build_linear_skb() into dpaa2_switch_rx(), allowing the code to call free_pages() if no SKB was created and kfree_skb() otherwise, thus correcting the memory management on error paths.

Improper memory freeing on error paths in the dpaa2-switch driver could lead to memory corruption or leaks in the Linux kernel. This may affect system stability or security depending on how the kernel handles such memory mismanagement. No known exploits are reported in the wild.

A fix for this vulnerability has been implemented in the Linux kernel source code by correcting the error handling in dpaa2_switch_rx(). Users should update to a Linux kernel version that includes this fix once it is released. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel advisory for the exact fixed versions and update accordingly.