UBUNTU-CVE-2026-97966: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIOANCHOR/RRPRIO settings can survive in the shared scheduler pool and affect later allocations. Add otx2qosresetschqtopology() and otx2qosfreehwschq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nixtxschqfreeone().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq(), and invoke them before each scheduler queue is returned to the AF during hierarchy teardown and configuration rollback. Do not reset TL1 because it is a shared per-Tx-link queue and is not freed by nix_txschq_free_one().
Linux kernel octeontx2-pf HTB scheduler NIX_AF_TLxX_TOPOLOGY = zero TL4 through TL2
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The issue affects the listed Ubuntu kernel packages when the OcteonTX2 PF QoS HTB offload path allocates and later frees scheduler queues. It concerns shared scheduler-pool state, so later queue allocations can inherit topology settings left by an earlier hierarchy.
What conditions are needed for the stale scheduler topology to matter?
HTB offload must program scheduler topology on QoS-allocated queues, followed by hierarchy teardown or configuration rollback that returns those queues to the allocator. A later allocation of affected scheduler queues can then be influenced by surviving PRIO_ANCHOR or RR_PRIO topology settings.
Is the default transmit hierarchy affected?
The aggregation level, TL1, is not reset by the fix because it is shared by the PF, the default transmit hierarchy, and VFs, and is not returned to the allocator by the queue-free operation. The described stale-state problem applies to freed TL4 through TL2 scheduler queues.
How can I determine whether a system may have encountered the issue?
Review whether the system has used OcteonTX2 PF HTB QoS offload and subsequently removed or rolled back QoS hierarchies. The provided data does not specify a user-visible detection method or affected version range.