In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num_napi when the napi vectors are freed fbn->num_napi is the… (CVE-2026-98616)

The Linux kernel fbnic driver maintains a count (num_napi) of live napi vectors, each associated with an IRQ. During power management suspend, the driver frees these vectors but did not clear num_napi, leaving it pointing to freed memory if the datapath is torn down but not rebuilt. This occurs in two scenarios: a failed PCIe error recovery where resume does not run, and a partial failure during resume open that unwinds after num_napi is set. Subsequent network device removal triggers a NULL pointer dereference in fbnic_dbg_down due to dereferencing freed vectors. The fix clears num_napi when freeing vectors during suspend teardown and resume open failure, preventing the use-after-free condition.

This vulnerability can cause a kernel NULL pointer dereference leading to a system crash (kernel panic) when the affected network device is removed or unbound after specific failure conditions. It affects system stability but does not indicate direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to clear the num_napi counter when napi vectors are freed during suspend teardown and resume open failure. Users should apply the official kernel updates containing this fix once available. No additional mitigation is indicated.