CVE-2026-97966: octeontx2-pf: reset HTB scheduler topology before freeing queues
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: reset HTB scheduler topology before freeing queues
HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIOANCHOR/RRPRIO settings can survive in the shared scheduler pool and affect later allocations.
Add otx2qosresetschqtopology() and otx2qosfreehwschq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nixtxschqfreeone().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In octeontx2-pf HTB offload teardown and configuration rollback, reset the TL4-through-TL2 scheduler topology before returning each scheduler queue to the AF; skip TL1, and add/use otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() so NIX_AF_TLxX_TOPOLOGY is cleared before queues are freed.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel octeontx2-pf driver with HTB offload and QoS-allocated scheduler queues are exposed. The affected teardown paths return scheduler queues to a shared allocation pool without first clearing their topology settings.
What conditions are required for the stale scheduler state to matter?
HTB offload must program topology on scheduler queues, and those queues must later be freed during hierarchy teardown or configuration rollback. A later allocation from the shared scheduler pool can then inherit surviving PRIO_ANCHOR or RR_PRIO settings.
How can administrators determine whether they may be affected?
Review whether the system uses the octeontx2-pf driver and HTB QoS offload. Systems that create and tear down HTB hierarchies or experience QoS configuration rollbacks are the relevant cases.
What is the remediation described by the fix?
The fix clears TOPOLOGY for TL4 through TL2 scheduler queues before returning each queue to the AF. TL1 is intentionally not cleared because it is shared by the PF, default transmit hierarchy, and VFs and is not returned to the AF by the queue-freeing path.