CVE-2026-98585: eth: fbnic: Avoid rounding zero ring sizes
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: Avoid rounding zero ring sizes
rounduppowoftwo() is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it.
Leave zero unchanged while rounding nonzero ring sizes. The minimum-size check then rejects zero deterministically without changing the established behavior for other values.
Affected Software
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
The issue applies to Linux kernel systems using the fbnic Ethernet driver, where ring sizes can be configured through ethtool.
What is needed to reach the vulnerable code path?
A zero ring-size value must be passed through ethtool to the driver. The problem occurs when that zero value is sent to roundup_pow_of_two() before the driver's minimum-size validation rejects it.
What behavior does the fix introduce for zero ring sizes?
Zero is no longer rounded. It is left unchanged so that the existing minimum-size check rejects it deterministically, while nonzero ring-size behavior remains unchanged.