CVE-2026-97434 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux kernel-based systems should assess exposure and apply patches as necessary.

Why it matters

A vulnerability in the Linux kernel's dp2a-switch handling of NAPI on the remove path has been resolved. Linux kernel developers and maintainers, network administrators, and security teams should assess exposure and apply patches as necessary to prevent potential issues with NAPI instances.

• Verify proper NAPI instance handling on dp2a-switch remove path to prevent premature deletion.
• Ensure all ports are properly unregistered and freed to prevent NAPI instance issues.
• Monitor system logs for dp2a-switch and NAPI instance-related issues.

Technical summary

The Linux kernel's dp2a-switch handling of NAPI on the remove path has been resolved. The NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled. To fix this, the unregister_netdev() calls are split from the free_netdev() calls to ensure all ports go down before attempting to delete NAPI instances.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patches to ensure the dp2a-switch NAPI instances are properly handled on the remove path.
• Verify that all ports are properly unregistered and freed to prevent NAPI instances from being deleted prematurely.
• Monitor system logs for any issues related to dp2a-switch and NAPI instances.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions is not explicitly stated. The Linux kernel patch references are provided, but no additional information on exploitation or impact is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.