{"id":"CVE-2026-98619","kind":"vulnerability","aliases":["CVE-2026-98619"],"related":[],"title":"Linux kernel: ethtool self test tears down device without rtnl_lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: keep rtnl_lock for the ioctl self test\n\nAn offline self test that brings the interface down and back up with\nnetif_close() / netif_open() requires rtnl_lock for both. Since the\nethtool IOCTL path became rtnl-optional for ops-locked drivers, the\nETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an\nops-locked driver the self test now tears the device down without\nrtnl_lock.\n\nWith lockdep this reproduces deterministically on every offline self\ntest on such a driver; note the sole lock held is the instance lock, not\nrtnl:\n\n  WARNING: suspicious RCU usage\n  net/core/netpoll.c:207 suspicious rcu_dereference_protected() usage!\n  1 lock held by ethtool/107:\n   #0: (&dev->lock){+.+.}, at: dev_ethtool\n  Call Trace:\n   netpoll_poll_disable\n   __dev_close_many\n   netif_close_many\n   netif_close\n   fbnic_self_test\n   dev_ethtool_locked\n   dev_ethtool\n   dev_ioctl\n   sock_ioctl\n   __x64_sys_ioctl\n\nWithout lockdep the same condition trips ASSERT_RTNL() in\n__dev_close_many() / __dev_open(); that check only samples the global\nrtnl state, so it can be masked by a concurrent rtnl holder, but the\ndevice is still being reconfigured without the lock it requires.\n\nThe ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST\ncase is only needed on the ioctl path. Add an opt-in bit for drivers whose\nself test needs rtnl_lock and set it on the ops-locked drivers whose\noffline self test tears the interface down and up:\n\n  - fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path\n    uses netif_close() / netif_open().\n  - bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path\n    goes through bnxt_close_nic() / bnxt_half_open_nic() /\n    bnxt_half_close_nic() / bnxt_open_nic(), which close and reopen the\n    device.","summary":"On ops-locked network drivers (fbnic, bnxt), the ethtool offline self test brings the interface down and back up while holding only the instance lock instead of rtnl_lock, so the device is reconfigured without the lock it requires. The sources describe a kernel warning and a race in device reconfiguration; they do not describe a direct way for an attacker to gain code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bnxt","ethtool","fbnic","linux-kernel","package"],"not_affected_if":["no-bnxt-or-fbnic-nic","no-ethtool-self-test"],"how_to_check":"- Run `uname -r` and check whether the kernel predates the fix commit that adds the rtnl opt-in bit\n- Run `lspci | grep -i -E 'bnxt|broadcom|fbnic'` to see whether a bnxt or fbnic NIC is present\n- unknown whether the sources give a specific fixed kernel version","fix":"- Install a Linux kernel build that includes the upstream fix for the ethtool rtnl_lock change (fixed version unknown from sources)\n- Avoid running offline ethtool self tests on affected bnxt or fbnic hosts until patched","status":"open","published_at":"2026-10-18T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:18+00:00","updated_at":"2026-10-25T05:21:18+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:21:18Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream fix for the ethtool rtnl_lock change (fixed version unknown from sources)\n- Avoid running offline ethtool self tests on affected bnxt or fbnic hosts until patched","reach":"local","title":"Linux kernel: ethtool self test tears down device without rtnl_lock","impact":"low","summary":"On ops-locked network drivers (fbnic, bnxt), the ethtool offline self test brings the interface down and back up while holding only the instance lock instead of rtnl_lock, so the device is reconfigured without the lock it requires. The sources describe a kernel warning and a race in device reconfiguration; they do not describe a direct way for an attacker to gain code execution.","category":"package","nicknames":[],"who_cares":["linux-kernel","bnxt","fbnic","ethtool"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe a device reconfiguration race and kernel warning","analyst_note":"Check the upstream kernel commit and NVD entry CVE-2026-98619 to confirm fixed kernel versions and whether the race has a demonstrated security impact.","how_to_check":"- Run `uname -r` and check whether the kernel predates the fix commit that adds the rtnl opt-in bit\n- Run `lspci | grep -i -E 'bnxt|broadcom|fbnic'` to see whether a bnxt or fbnic NIC is present\n- unknown whether the sources give a specific fixed kernel version","needs_analyst":true,"not_affected_if":["no-bnxt-or-fbnic-nic","no-ethtool-self-test"],"who_is_affected":"Hosts that run a Linux kernel with bnxt or fbnic network drivers and use ethtool self tests (for example `ethtool -t`) are the ones exposed. Systems without these NICs, or without the ioctl self test in use, are unlikely to be affected; the sources do not say who can trigger the path beyond the local ioctl.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000768,"input_tokens":4000,"output_tokens":736,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98619':14A,17A '0':217C '1':212C '207':206C 'add':318C 'assert':257C 'attack':86B 'back':43B,121C 'becam':138C 'bit':323C 'bnxt':18B,32B,369C,377C,384C,387C,391C,395C 'bring':38B,116C 'call':223C 'case':310C 'check':266C 'close':125C,229C,232C,235C,261C,366C,385C,393C,399C 'code':89B 'command':305C 'concurr':280C 'condit':255C 'cve':12A,15A 'derefer':209C 'describ':67B,80B 'determinist':180C 'dev':218C,221C,228C,239C,242C,244C,260C,263C 'devic':8A,57B,75B,171C,285C,403C 'direct':82B 'disabl':227C 'driver':30B,146C,164C,189C,325C,340C 'ethtool':3A,19B,34B,102C,135C,148C,222C,240C,243C,296C,308C 'ethtool/107':216C 'everi':182C 'execut':90B 'fbnic':20B,31B,236C,351C,359C 'follow':96C 'gain':88B 'global':270C 'goe':382C 'half':388C,392C 'held':194C,214C 'hold':46B,152C 'holder':282C 'instanc':49B,156C,197C 'instead':51B 'interfac':40B,118C,347C 'ioctl':108C,136C,150C,245C,247C,250C,303C,316C 'ioctl-on':302C 'keep':103C 'kernel':2A,23B,69B,94C 'legaci':301C 'linux':1A,22B,93C 'linux-kernel':21B 'lock':11A,28B,50B,54B,62B,105C,130C,145C,157C,163C,175C,193C,198C,213C,219C,241C,292C,331C,339C,354C,372C 'lockdep':177C,252C 'mani':230C,233C,262C 'mask':277C 'mgmt':357C,375C 'need':313C,329C 'net':101C 'net/core/netpoll.c':205C 'netdev':155C 'netif':124C,126C,231C,234C,365C,367C 'netpol':225C 'network':29B 'nic':386C,390C,394C,397C 'note':190C 'offlin':35B,112C,183C,342C,362C,380C 'op':27B,144C,162C,338C,353C,358C,371C,376C 'open':127C,264C,368C,389C,396C 'ops-lock':26B,143C,161C,337C,352C,370C 'opt':321C 'opt-in':320C 'option':141C 'packag':24B 'path':137C,317C,363C,381C 'poll':226C 'protect':210C 'queue':356C,374C 'race':73B 'rcu':203C,208C 'reconfigur':59B,76B,289C 'reopen':401C 'reproduc':179C 'requir':64B,128C,294C 'resolv':100C 'rtnl':10A,53B,104C,129C,140C,174C,200C,258C,271C,281C,330C 'rtnl-option':139C 'run':151C 'sampl':268C 'self':4A,36B,109C,113C,166C,184C,237C,297C,327C,343C,360C,378C 'set':333C 'sinc':133C 'sock':246C 'sole':192C 'sourc':66B 'state':272C 'still':287C 'suspici':202C,207C 'sys':249C 'tear':6A,169C,345C 'test':5A,37B,110C,114C,149C,167C,185C,238C,298C,309C,328C,344C,361C,379C 'trace':224C 'trip':256C 'usag':204C,211C 'use':364C 'via':355C,373C 'vulner':97C 'warn':70B,201C 'way':83B 'whose':326C,341C 'without':9A,60B,173C,251C,290C 'x64':248C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run a Linux kernel with bnxt or fbnic network drivers and use ethtool self tests (for example `ethtool -t`) are the ones exposed. Systems without these NICs, or without the ioctl self test in use, are unlikely to be affected; the sources do not say who can trigger the path beyond the local ioctl.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98619","severity":null,"published_at":"2026-10-18T16:17:14+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}