CVE-2026-72409: net: mvneta: re-enable percpu interrupt on resume
In the Linux kernel, the following vulnerability has been resolved:
net: mvneta: re-enable percpu interrupt on resume
On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR (mvnetapercpuisr) calls disablepercpuirq() to mask the MPIC per-CPU interrupt and schedules NAPI poll, which calls enablepercpuirq() on completion to unmask.
If suspend occurs while NAPI poll is pending (between disablepercpuirq in the ISR and enablepercpuirq in poll completion), the interrupt is never re-enabled:
1. mvnetapercpuisr: disablepercpuirq() + napischedule() => MPIC masked, percpuenabled cpumask bit cleared 2. NAPI poll does not complete before suspend proceeds (on PREEMPTRT this is highly likely since softirqs run in ksoftirqd which gets frozen; on non-RT it can happen when softirq processing is deferred to ksoftirqd) 3. mvnetastopdev => napidisable(): cancels the pending poll without executing the completion path 4. suspenddeviceirqs => IRQCHIPMASKONSUSPEND: masks MPIC (already masked, but records IRQSSUSPENDED) 5. Resume: mpicresume checks irqpercpuisenabled() => false (bit was cleared in step 1) => skips unmask 6. mvnetastartdev only restores device-level INTRNEWMASK, does not touch the MPIC per-CPU mask
Result: MPIC per-CPU interrupt stays masked permanently. The NIC generates interrupts (INTRNEWCAUSE != 0) but the CPU never receives them, causing complete loss of network connectivity.
Fix by calling oneachcpu(mvnetapercpuenable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt regardless of pre-suspend state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the resume path, call on_each_cpu(mvneta_percpu_enable) to re-enable the MPIC per-CPU interrupt that may remain masked after suspend.
Linux kernel net driver: Marvell mvneta (NAPI per-CPU IRQ / MPIC on Armada 370/XP/38x) resume path should re-enable per-CPU MPIC interrupts = call on_each_cpu(mvneta_percpu_enable) - Configuration
Ensure the NAPI poll completion path calls enable_percpu_irq() (so that the MPIC per-CPU interrupt is unmasked after NAPI poll completes), rather than allowing completion to be skipped when suspend proceeds.
Marvell mvneta (NAPI poll vs suspend interaction) NAPI poll completion interrupt unmasking = ensure enable_percpu_irq() runs on completion - Compensating control
Use the Linux kernel’s IRQ suspend behavior to unconditionally unmask the MPIC per-CPU interrupt on resume via IRQCHIP_MASK_ON_SUSPEND, so it is unmasked regardless of whether the NAPI completion path executed.