CVE-2026-72409 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, users of Marvell MPIC platforms (Armada 370/XP/38x) with mvneta driver, network administrators, and security teams responsible for patching and vulnerability management. These stakeholders should be aware of the vulnerability and take necessary actions to apply the fix and monitor their systems for any potential impact. Additionally, operators of affected platforms and those responsible for system configurations and updates should review their configurations and update device drivers as necessary to prevent similar issues in the future. Security teams should also review their compensating controls and monitoring to ensure they can detect and respond to potential exploitation attempts related to this vulnerability. Asset inventory managers should verify that affected systems are properly tracked and prioritized for remediation. Those responsible for change management and rollback procedures should also be aware of the need for careful planning and testing of the fix to minimize disruptions to critical systems and services. Finally, source tracking and vulnerability management teams should ensure that all relevant information about this vulnerability is properly documented and tracked to facilitate effective remediation and risk management efforts across the organization. This includes coordinating with vendors, tracking affected systems, and verifying the effectiveness of the fix in preventing exploitation. By taking these steps, organizations can reduce their risk exposure and ensure the security and reliability of their systems and services. The vulnerability's impact on network connectivity and the availability of a fix make it essential for affected stakeholders to prioritize its remediation and take proactive measures to protect their systems and data. Effective communication and collaboration among these stakeholders are crucial to ensuring a coordinated and efficient response to this vulnerability. By working together and taking a proactive approach to vulnerability management, organizations can minimize the risk of exploitation and maintain the security and integrity of their systems and services. Therefore, it is

Technical summary

The mvneta driver in the Linux kernel did not re-enable percpu interrupts on resume, causing a loss of network connectivity on Marvell MPIC platforms (Armada 370/XP/38x). The issue was resolved by calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt. This fix addresses the problem by ensuring that the percpu interrupts are properly re-enabled during the resume process, thus restoring network connectivity.

Defensive priority

Medium

Recommended defensive actions

• Verify and apply the kernel patch to ensure percpu interrupts are re-enabled on resume.
• Monitor network connectivity and interrupts on affected systems.
• Review system configurations and update device drivers as necessary.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was resolved by calling on_each_cpu(mvneta_percpu_enable) in the resume path to unconditionally unmask the MPIC per-CPU interrupt. The issue occurred on Marvell MPIC platforms (Armada 370/XP/38x) where mvneta uses a percpu IRQ disable/enable scheme for NAPI.

Official resources