UBUNTU-CVE-2026-98616: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn->numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend() tears the datapath down via ndostop() and frees the IRQs, but leaves netifrunning() true so resume knows to re-open. Resume rebuilds the datapath in fbnicpmresume() and fbnicresetqueues() sets numnapi and fbnicopen() re-allocates the vectors. When the datapath is torn down but never rebuilt, numnapi is left pointing at freed vectors under 2 different scenarios: - a PCIe error recovery that fails (fbnicerrslotreset() -> fbnicpmresume() returns an error -> PCIERSRESULTDISCONNECT), so .resume never runs; or - an fbnicopen() that fails partway on resume and unwinds, freeing the vectors after fbnicresetqueues() has already set numnapi. The netdev is then running with numnapi > 0 but napi[] freed, and the eventual remove/unbind close re-enters fbnicdown() -> fbnicdbgdown() and dereferences the freed vectors: BUG: kernel NULL pointer dereference, address: 0000000000000210 RIP: fbnicdbgdown+0x28 Clear numnapi when the vectors are freed: in the suspend teardown (a good resume re-establishes it before fbnicopen()) and on the resume open failure. A redundant ndostop() then walks an empty napi[]. The normal ndostop() down/up cycle is untouched and keeps numnapi for the next ndoopen().