In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up… (CVE-2026-98906)

The vulnerability in the Linux kernel lan966x driver occurs because lan966x_fdma_reload() backs up some RX state fields before reallocating RX resources for a new MTU but fails to restore all updated fields (rx->page_order and rx->max_mtu) on allocation failure. Consequently, RX may restart with old pages and FDMA state but with page geometry from the failed new MTU, causing the XDP path to advertise a frame size larger than the actual RX pages. Additionally, the rollback path does not restore per-port XDP RXQ memory model registration after fdma_alloc_coherent() failure, leading to inconsistent RX state. The fix involves saving and restoring these fields and registrations to maintain consistent RX state after reload failures.

The inconsistent RX state after a failed reload can cause the XDP path to operate with mismatched frame sizes and buffer allocations, which may lead to incorrect packet processing or dropped packets. No active exploits are known, and the impact is limited to RX buffer management inconsistencies within the lan966x network driver.

A fix has been implemented in the Linux kernel to properly save and restore all relevant RX state fields and registrations after a reload failure in the lan966x driver. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.