CVE-2026-97966 octeontx2-pf: reset HTB scheduler topology before freeing queues
A flaw in the Linux kernel octeontx2-pf driver allows stale scheduler topology settings to persist, potentially affecting network traffic scheduling for other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97966?
CVE-2026-97966 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: reset HTB scheduler topology before freeing queues
HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler queues via otx2_qos_txschq_set_parent_topology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the shared scheduler pool and affect later allocations.
Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nix_txschq_free_one().
Which versions are affected by CVE-2026-97966?
How do I fix CVE-2026-97966?
Apply the vendor's patch.
Is CVE-2026-97966 being exploited?
There is no known exploitation of CVE-2026-97966 in the wild and no public exploit code.
Sources
Also known as AZL-104250, BELL-CVE-2026-97966, DEBIAN-CVE-2026-97966, GHSA-m5mf-8q2j-8cgp, UBUNTU-CVE-2026-97966.