CVE-2026-97613 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems should assess exposure and apply the patch to prevent potential issues. They should verify patch application to prevent potential RX completion queue issues and monitor system logs for potential issues related to the vulnerability.

Why it matters

The vulnerability can lead to dropping a fence completion CQE when the RX completion queue is full, causing the driver to wait holding the RTNL lock throughout a timeout duration. Linux kernel developers and administrators should assess exposure and apply the patch.

• Verify patch application to prevent potential RX completion queue issues
• Monitor system logs for potential issues related to the vulnerability

Technical summary

The Linux kernel's network mana (MANA) driver has a vulnerability where the RX completion queue is sized to hold exactly one CQE per posted RX WQE, but the hardware posts an additional CQE_RX_OBJECT_FENCE after packet CQEs, potentially leading to dropping the fence completion. The current sizing reserves no extra slot for it and in rare cases, CQ has no guaranteed slot for the fence CQE when it is full of packet CQEs. This can lead to dropping the fence completion while the driver waits holding RTNL lock throughout the timeout duration.

Defensive priority

Verify and apply the patch to ensure the RX completion queue has an extra slot for the fence completion CQE.

Recommended defensive actions

• Verify the Linux kernel version and check if the patch is applied
• Review system configurations and ensure the MANA driver is properly configured
• Monitor system logs for potential issues related to the vulnerability
• Apply the patch to ensure the RX completion queue has an extra slot for the fence completion CQE
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions, exploitation, impact, or remediation beyond applying the patch. The vulnerability affects the Linux kernel's network mana (MANA) driver. The RX completion queue is sized to hold exactly one CQE per posted RX WQE, but the hardware posts an additional CQE_RX_OBJECT_FENCE after packet CQEs. The current sizing reserves no extra slot for it and in rare cases, CQ has no guaranteed slot for the fence CQE when it is full of packet CQEs. This can be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.