In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that… (CVE-2026-98619)

The Linux kernel's ethtool ioctl self test previously did not hold the rtnl_lock when performing an offline self test that brings the network interface down and back up using netif_close() and netif_open(). Since the ethtool IOCTL path became rtnl-optional for ops-locked drivers, the ETHTOOL_TEST ioctl ran holding only the netdev instance lock, causing the self test to reconfigure the device without the required rtnl_lock. This led to deterministic lockdep warnings and potential ASSERT_RTNL() failures on affected drivers. The fix introduces an opt-in bit for drivers whose self test requires rtnl_lock and sets it for ops-locked drivers like fbnic and bnxt, ensuring the lock is held during the offline self test.

The vulnerability could cause kernel warnings and assertion failures during the ethtool offline self test on certain ops-locked drivers, potentially leading to unstable device reconfiguration. There is no indication of remote code execution or privilege escalation. The impact is limited to kernel stability and correctness during self tests.

A fix has been implemented in the Linux kernel to add an opt-in bit for drivers requiring rtnl_lock during the ethtool self test and to set this bit for affected ops-locked drivers. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required beyond applying the official patch.