Live › vulnerability › CVE-2026-98967
Go to dashboardIn the Linux kernel's cxgb4 Chelsio driver for kTLS offload, cleanup paths erase entries from a shared XArray without disabling softirqs, so a receive softirq on the same CPU can spin on a lock held by the interrupted task. The sources describe a lock-ordering hang, not code execution or data theft.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the cxgb4 Chelsio network driver and kTLS inline offload enabled are the ones exposed. Hosts without Chelsio T4/T5/T6 adapters, or without kTLS offload in use, can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
cxgb4/ch_ktls: disable softirqs around tid_list erases
chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs.
When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.
This page as .md · .json · in your agent: get_signal("CVE-2026-98967")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.