Live › vulnerability › CVE-2026-98911
Go to dashboardIn the Linux kernel's dpaa2-switch driver, an error during frame receive calls a free routine meant for transmit descriptors, freeing memory incorrectly. The sources do not describe a confirmed attacker outcome beyond memory handling being wrong on an error path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the dpaa2-switch driver, which is used on NXP DPAA2 hardware with switch functionality, are relevant. Systems without that hardware or driver can skip it. The sources do not describe a remote trigger.
No product ranges from the sources yet.
uname -r and compare it against the fixed kernel release in the NVD entry.lsmod | grep dpaa2_switch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: fix the error path in dpaa2_switch_rx()
In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call dev_kfree_skb().
Fix this by extracting the dma_unmap_page() from dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx() function. This allows us to directly use free_pages() in case of an error before an SKB was created and kfree_skb() afterwards.
This page as .md · .json · in your agent: get_signal("CVE-2026-98911")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.