{"id":"CVE-2026-98967","revision":"e485db087b9a4d2e9f88eacfc2c84ac5","records":[{"revision":"e485db087b9a4d2e9f88eacfc2c84ac5","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-98967","aliases":[],"title":"cxgb4/ch_ktls: disable softirqs around tid_list erases","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxgb4/ch_ktls: disable softirqs around tid_list erases\n\nchcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path\nusing xa_insert_bh().  The array is shared by the adapter's connections\nand initialized with XA_FLAGS_LOCK_BH.  However, chcr_ktls_dev_del() and\nthe chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray\nlock without disabling softirqs.\n\nWhen cleanup runs with softirqs enabled, a receive softirq for another\nconnection on the same CPU can interrupt the erase and spin on the lock\nheld by the interrupted task.  Use xa_erase_bh() at both sites to match\nthe insertion path.","state":0,"publishedAt":"2026-10-23T12:19:37.625+00:00","modifiedAt":"2026-10-23T12:19:37.625+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"65e302a9bd57b62872040d57eea1201562a7cbb2\",\n                            \"lessThan\": \"8739f06e3f82cd715f7dd10ab24029ed881efc90\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"65e302a9bd57b62872040d57eea1201562a7cbb2\",\n                            \"lessThan\": \"bcf97573d44e277b1744d7f1226f665aa0ccc599\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"65e302a9bd57b62872040d57eea1201562a7cbb2\",\n                            \"lessThan\": \"7110c7f70c59eb7924e79853bcc00e2a026662e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"65e302a9bd57b62872040d57eea1201562a7cbb2\",\n                            \"lessThan\": \"bea736a2b8c6da5b1078badf1206541b5404250f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"65e302a9bd57b62872040d57eea1201562a7cbb2\",\n                            \"lessThan\": \"4c9dc0faca98084922caeb689579d338cf3e1c29\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96adbf6601d76ee0bdd9bfa5bcdd0cdd5333d78\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"70c4ead897211b184f36cbeda213f2a3e8153218\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.42\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.12.9\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8739f06e3f82cd715f7dd10ab24029ed881efc90","https://git.kernel.org/stable/c/bcf97573d44e277b1744d7f1226f665aa0ccc599","https://git.kernel.org/stable/c/7110c7f70c59eb7924e79853bcc00e2a026662e6","https://git.kernel.org/stable/c/bea736a2b8c6da5b1078badf1206541b5404250f","https://git.kernel.org/stable/c/4c9dc0faca98084922caeb689579d338cf3e1c29"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98967","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98967","identifiers":["CVE-2026-98967"]},"retained":false,"historicalAffected":[]}],"coverage":[]}