Live › vulnerability › CVE-2026-98630
Go to dashboardWhen the fbnic network driver fails to allocate its payload page pool, the cleanup path passes an error pointer to page_pool_destroy() and leaves the header page pool allocated. The sources do not describe a way for an attacker to trigger it or what they could gain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the fbnic driver, which is the Meta Platforms Fbnic Ethernet driver, are in scope; the sources do not say which kernel versions carry the bug. Systems without fbnic hardware or without the module loaded can likely skip it. Whether an attacker can reach this error path from the network is unknown.
No product ranges from the sources yet.
uname -r and whether the fbnic driver is loaded with lsmod | grep fbnicEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: Fix payload page pool error cleanup
The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to page_pool_destroy() instead of destroying the header page pool. This can dereference the error pointer and leave the header page pool allocated.
Destroy the header page pool instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98630")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.