CVE-2026-98967 cxgb4/ch_ktls: disable softirqs around tid_list erases
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98967?
CVE-2026-98967 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cxgb4/ch_ktls: disable softirqs around tid_list erases
chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray lock without disabling softirqs.
When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa_erase_bh() at both sites to match the insertion path.
Which versions are affected by CVE-2026-98967?
How do I fix CVE-2026-98967?
Upgrade to a fixed version.
Is CVE-2026-98967 being exploited?
There is no known exploitation of CVE-2026-98967 in the wild and no public exploit code.
Sources
Also known as AZL-110783, BELL-CVE-2026-98967, DEBIAN-CVE-2026-98967, GHSA-hvvf-g7gg-pmx4, UBUNTU-CVE-2026-98967.