CVE-2026-98630: eth: fbnic: Fix payload page pool error cleanup
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: Fix payload page pool error cleanup
The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy() instead of destroying the header page pool. This can dereference the error pointer and leave the header page pool allocated.
Destroy the header page pool instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the payload page pool allocation-failure cleanup path, destroy the header page pool instead of passing the error-pointer payload page pool to page_pool_destroy().
Linux kernel eth: fbnic payload page pool error cleanup = page_pool_destroy(header_page_pool)
Event History
Frequently Asked Questions
When can the faulty cleanup path be reached?
It is reached when allocation of the payload page pool fails. In that case, the payload page pool pointer holds an error pointer, but the cleanup path passes it to page_pool_destroy().
What is the impact of the cleanup failure?
The erroneous cleanup can dereference the error pointer and can leave the header page pool allocated. The corrected behavior is to destroy the header page pool instead.