CVE-2026-98909 net: cpsw_new: unregister devlink on port registration failure

Not scored Published 23 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98909?

CVE-2026-98909 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

net: cpsw_new: unregister devlink on port registration failure

cpsw_probe() registers devlink before registering the CPSW ports.

If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed.

Add a devlink cleanup label for the path where devlink registration has already succeeded, and use it when port registration fails.

Which versions are affected by CVE-2026-98909?

How do I fix CVE-2026-98909?

Upgrade to a fixed version.

Is CVE-2026-98909 being exploited?

There is no known exploitation of CVE-2026-98909 in the wild and no public exploit code.

Sources

Also known as AZL-110671, BELL-CVE-2026-98909, DEBIAN-CVE-2026-98909, GHSA-7h76-g88g-x9j7, UBUNTU-CVE-2026-98909.