{"id":"CVE-2026-98630","kind":"vulnerability","aliases":["CVE-2026-98630"],"related":[],"title":"Linux kernel fbnic driver: error cleanup can dereference a bad pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Fix payload page pool error cleanup\n\nThe payload page pool pointer contains an error pointer when its\nallocation fails. The cleanup path passes that error pointer to\npage_pool_destroy() instead of destroying the header page pool. This\ncan dereference the error pointer and leave the header page pool\nallocated.\n\nDestroy the header page pool instead.","summary":"When the fbnic network driver fails to allocate its payload page pool, the cleanup path passes an error pointer to page_pool_destroy() and leaves the header page pool allocated. The sources do not describe a way for an attacker to trigger it or what they could gain.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fbnic","infrastructure","kernel","linux","network-drivers"],"not_affected_if":["fbnic-not-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and whether the fbnic driver is loaded with `lsmod | grep fbnic`\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for this commit; the sources do not name a version\n- unknown","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:06+00:00","updated_at":"2026-10-25T05:21:06+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for this commit; the sources do not name a version\n- unknown","reach":"local","title":"Linux kernel fbnic driver: error cleanup can dereference a bad pointer","impact":"low","summary":"When the fbnic network driver fails to allocate its payload page pool, the cleanup path passes an error pointer to page_pool_destroy() and leaves the header page pool allocated. The sources do not describe a way for an attacker to trigger it or what they could gain.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","fbnic","network-drivers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources describe a dereference of an error pointer during cleanup","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, a severity score, and whether the error path is reachable without privileges.","how_to_check":"- Check the running kernel version with `uname -r` and whether the fbnic driver is loaded with `lsmod | grep fbnic`\n- unknown","needs_analyst":true,"not_affected_if":["fbnic-not-loaded"],"who_is_affected":"Only systems that load the fbnic driver, which is the Meta Platforms Fbnic Ethernet driver, are in scope; the sources do not say which kernel versions carry the bug. Systems without fbnic hardware or without the module loaded can likely skip it. Whether an attacker can reach this error path from the network is unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00062,"input_tokens":3359,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98630':14A,17A 'alloc':32B,54B,102C,134C 'attack':64B 'bad':10A 'cleanup':6A,38B,90C,105C 'contain':96C 'could':71B 'cve':12A,15A 'derefer':8A,124C 'describ':59B 'destroy':47B,114C,117C,135C 'driver':4A,24B,29B 'error':5A,42B,89C,98C,109C,126C 'eth':83C 'fail':30B,103C 'fbnic':3A,18B,27B,84C 'fix':85C 'follow':78C 'gain':72B 'header':51B,119C,131C,137C 'infrastructur':19B 'instead':115C,140C 'kernel':2A,20B,76C 'leav':49B,129C 'linux':1A,21B,75C 'network':23B,28B 'network-driv':22B 'page':35B,45B,52B,87C,93C,112C,120C,132C,138C 'pass':40B,107C 'path':39B,106C 'payload':34B,86C,92C 'pointer':11A,43B,95C,99C,110C,127C 'pool':36B,46B,53B,88C,94C,113C,121C,133C,139C 'resolv':82C 'sourc':56B 'trigger':66B 'vulner':79C 'way':61B","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the fbnic driver, which is the Meta Platforms Fbnic Ethernet driver, are in scope; the sources do not say which kernel versions carry the bug. Systems without fbnic hardware or without the module loaded can likely skip it. Whether an attacker can reach this error path from the network is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98630","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}