CVE-2026-98277: eth: fbnic: ring the doorbell if a burst ends in a drop
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: ring the doorbell if a burst ends in a drop
fbnictxmap() skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them all. When that packet is dropped instead - skbputpadto(), skbcowhead() or a DMA mapping failure - nothing rings. The descriptors of the preceding packets stay invisible to the HW until the next transmit on that queue, which for a burst-then-idle workload may never come.
Remember the meta descriptor of the last packet left without a doorbell and flush it from the error paths. The completion request has to be set on that descriptor rather than simply writing the tail, otherwise the HW would transmit the packets but never report a head, and the ring would fill up and stall for good.
This is very similar to Joe's recent series of fixes for bnxt. Not seen in real life, reproduced under QEMU with failure injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Linux systems using the fbnic transmit path are affected when packets are sent in a burst using xmit_more and the packet expected to end that burst is dropped. A burst-then-idle workload is the most problematic case because no later transmission may occur to make the queued descriptors visible to hardware.
What can trigger the failure at the end of a transmit burst?
The final packet can be dropped during skb_put_padto(), skb_cow_head(), or DMA mapping. In that case, the preceding packets may remain unpublished because the expected doorbell write and completion request are skipped.
What is the operational impact?
Queued packets can remain invisible to the hardware until another transmission occurs on the same queue. If completion is not requested correctly, hardware may transmit packets without reporting ring progress, allowing the ring to fill and stall permanently.
Has this been observed in production?
The issue was not reported as seen in real-life use. It was reproduced under QEMU with failure injection.