CVE-2026-97966: octeontx2-pf: reset HTB scheduler topology before freeing queues
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: reset HTB scheduler topology before freeing queues
HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIOANCHOR/RRPRIO settings can survive in the shared scheduler pool and affect later allocations.
Add otx2qosresetschqtopology() and otx2qosfreehwschq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nixtxschqfreeone().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Call otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to clear TL4 through TL2 TOPOLOGY before each scheduler queue is returned to the AF during hierarchy teardown and configuration rollback; skip TL1.
octeontx2-pf HTB scheduler TL4 through TL2 TOPOLOGY = zero
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel octeontx2-pf driver with HTB offload and QoS-allocated scheduler queues are exposed. The affected teardown paths return scheduler queues to a shared allocation pool without first clearing their topology settings.
What conditions are required for the stale scheduler state to matter?
HTB offload must program topology on scheduler queues, and those queues must later be freed during hierarchy teardown or configuration rollback. A later allocation from the shared scheduler pool can then inherit surviving PRIO_ANCHOR or RR_PRIO settings.
How can administrators determine whether they may be affected?
Review whether the system uses the octeontx2-pf driver and HTB QoS offload. Systems that create and tear down HTB hierarchies or experience QoS configuration rollbacks are the relevant cases.
What is the remediation described by the fix?
The fix clears TOPOLOGY for TL4 through TL2 scheduler queues before returning each queue to the AF. TL1 is intentionally not cleared because it is shared by the PF, default transmit hierarchy, and VFs and is not returned to the AF by the queue-freeing path.