CVE-2026-97981: net: ethernet: cortina: Count dropped frames as NAPI work
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: cortina: Count dropped frames as NAPI work
The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can process the entire receive ring in one poll.
Move the budget accounting to a common end-of-frame path. This counts each completed frame as NAPI work whether it was delivered or dropped, matching the behavior of the vendor driver.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the excessive receive-ring processing?
The receive path must encounter a stream of bad frames. On affected code, dropped frames consume descriptors without consuming the NAPI polling budget, allowing one poll to process the entire receive ring.
What is the practical impact of the flawed budget accounting?
A stream of invalid frames can cause the driver to process all receive descriptors during a single NAPI poll rather than stopping at the configured budget. This can increase work performed in the receive polling context.
How can I determine whether the issue is fixed?
Check whether the kernel includes the change that moves NAPI budget accounting to a common end-of-frame path so that every completed frame, including dropped frames, counts as NAPI work. The listed stable kernel references identify fixes for this issue.