CVE-2026-97411 net: ibm: emac: mal: fix potential system hang in mal_remove()
A local attacker with high privileges can cause a system hang by removing the IBM EMAC MAL network driver module under specific conditions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97411?
CVE-2026-97411 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ibm: emac: mal: fix potential system hang in mal_remove()
napi_disable() is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPI_STATE_SCHED bit to clear.
In mal_remove(), napi_disable() is called unconditionally. If no MACs were registered, NAPI was never enabled. Also, if they were registered but subsequently unregistered, NAPI was already disabled in mal_unregister_commac(). In either case, calling napi_disable() causes the kernel to hang upon module removal.
Fix this by only calling napi_disable() in mal_remove() if the commac list is not empty (which implies NAPI is enabled).
Which versions are affected by CVE-2026-97411?
How do I fix CVE-2026-97411?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97411 being exploited?
There is no known exploitation of CVE-2026-97411 in the wild and no public exploit code.
Sources
Also known as AZL-103652, BELL-CVE-2026-97411, DEBIAN-CVE-2026-97411, GHSA-wcg4-82x5-ppxc, UBUNTU-CVE-2026-97411.