CVE-2026-98911
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
50/100
Published: 2026-10-23
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call dev_kfree_skb(). Fix this by extracting the dma_unmap_page() from dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx() function. This allows us to directly use free_pages() in case of an error before an SKB was created and kfree_skb() afterwards.