UBUNTU-CVE-2026-98615: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring() writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts the device's writes to the host but leaves the staged requests parked in the PUL write pipeline rather than draining them, so on the write path FLUSH alone never terminates the outstanding requests and the flush the firmware waits on never completes. Add the FLUSHMODE definition and set both bits so the staged writes drain out of the pipeline on their own. BME stays cleared, so nothing lands on the host; it is restored later in fbnicmbxinitdescring() when the ring is rebuilt, once the outstanding writes are gone. The read path is unaffected. ARCFG has no equivalent mode bit and ARFLUSH terminates the outstanding reads by itself, so it is left as is. Both writes remain plain stores rather than read-modify-writes. That is deliberate: the matching write in fbnicmbxinitdescring() restores BME and the TLP attributes, and clears both flush bits as a side effect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Add the FLUSH_MODE definition and set both AW_FLUSH and AW_FLUSH_MODE when flushing the mailbox; keep BME cleared so staged writes drain from the PUL write pipeline.
Linux kernel eth: fbnic mailbox AW_CFG = AW_FLUSH and AW_FLUSH_MODE set, BME cleared
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to the listed Ubuntu Linux kernel packages: linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The affected code is in the fbnic Ethernet driver’s firmware mailbox receive-ring teardown path.
What condition triggers the failure?
The failure occurs while tearing down the firmware mailbox receive ring, when outstanding staged device writes are present in the PUL write pipeline. With only the AW_FLUSH bit set and bus mastering disabled, those writes do not drain and the firmware’s flush operation may never complete.
Is the read path affected?
No. The description states that outstanding reads are terminated by AR_FLUSH alone, and the read-side configuration has no equivalent flush-mode bit.
What is the practical impact?
A firmware mailbox flush can fail to complete during receive-ring teardown because outstanding writes remain parked in the device write pipeline. The description does not provide further impact details such as remote exploitability, privilege requirements, or a workaround.