In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox When… (CVE-2026-98615)

The Linux kernel fbnic driver had a flaw in the mailbox Rx ring teardown process where fbnic_mbx_reset_desc_ring() cleared the BME bit while setting AW_FLUSH, causing staged write requests to remain in the PUL write pipeline without draining. This prevented the flush operation from completing, potentially leading to device communication issues. The fix adds setting AW_FLUSH_MODE alongside AW_FLUSH to allow staged writes to drain properly while keeping BME cleared. The BME bit is restored later during ring reinitialization. The read path remains unaffected as AR_FLUSH alone terminates outstanding reads.

The vulnerability could cause the firmware mailbox flush operation to hang indefinitely due to staged write requests not draining properly, potentially leading to device communication or stability issues during mailbox teardown. No impact on the read path was identified. There is no indication of exploitation in the wild or broader system compromise from the provided data.

A fix has been implemented in the Linux kernel to set AW_FLUSH_MODE alongside AW_FLUSH during mailbox flushing in the fbnic driver. Users should apply the official kernel update containing this fix when available. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed version and update accordingly.