In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline,… (CVE-2026-98558)

The vulnerability in the Linux kernel involves the dev_cpu_dead() function not flushing skb_defer_nodes when a CPU goes offline. This omission can leave socket buffers (skbs) stranded if the CPU goes offline while holding deferred skbs, especially those containing page_pool fragments. As a result, page_pool_destroy() may stall indefinitely during network device or driver teardown. Additional fixes include resetting defer_ipi_scheduled when smp_call_function_single_async() fails due to CPU offline, draining NUMA node slots if the last CPU on the node goes offline, and re-checking CPU online status in skb_attempt_defer_free() to close a preemption race condition. These changes collectively prevent indefinite stalls and resource leaks during CPU and node offline events.

The vulnerability could cause indefinite stalls in the Linux kernel's network teardown processes when CPUs go offline, potentially leading to system hangs or degraded network functionality. This occurs because deferred socket buffers holding page_pool fragments remain stranded and prevent resource cleanup. The issue affects system stability during CPU and NUMA node offline events.

A fix has been implemented in the Linux kernel to properly flush skb_defer_nodes during CPU offline events and address related race conditions. Users should apply the official kernel update that includes this patch to resolve the issue. No additional mitigation steps are indicated beyond applying the patch.