CVE-2026-97434: dpaa2-switch: fix handling of NAPI on the remove path
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: fix handling of NAPI on the remove path
All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goes down.
This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled.
In order to avoid this, split up the unregisternetdev() calls from the freenetdev() so that we make sure all ports go down before we attempt a deletion of NAPI instances. Also, make the netifnapidel() explicit as it is on the .probe() path.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
The issue applies to Linux kernel systems using the dpaa2-switch driver with a DPSW device. It is triggered during device removal rather than being described as a general packet-processing issue.
When does the unsafe teardown condition occur?
It occurs when switch ports are unregistered and freed one at a time while shared NAPI instances have not yet been disabled. The NAPI instances are attached to the first switch port's net_device but are shared across all ports.
What should the corrected removal sequence do?
All ports should be brought down through unregister_netdev() before their net_devices are freed. NAPI deletion should then occur only after the shared instances are disabled, with netif_napi_del() performed explicitly.