CVE-2026-97962 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as system administrators and users who rely on the Linux kernel, should be aware of this vulnerability and take necessary actions to ensure their systems are updated and secure.

Why it matters

A Linux kernel vulnerability was resolved, involving the movement of the representor vnic reporter to the eswitch devlink port. This change addresses a devl_assert_locked() splat that occurred during driver unbind due to the destruction of the reporter not being serialized by the devlink instance lock. Defenders should verify Linux kernel versions and apply patches to prevent potential issues.

• Defenders should verify Linux kernel versions and apply patches to prevent potential issues.
• System administrators should monitor system logs for any devl_assert_locked() splats during driver unbind.
• Linux kernel developers and maintainers should review and apply the kernel patch to ensure the representor vnic reporter is properly moved to the eswitch devlink port.

Technical summary

The Linux kernel vulnerability involved a devl_assert_locked() splat during driver unbind due to the destruction of the representor vnic devlink health reporter not being serialized by the devlink instance lock. The reporter was moved to the eswitch devlink port (un)register paths, which are already serialized by the devlink instance lock, and store the handle on mlx5_devlink_port. Use the port's mlx5_vport as the reporter priv since the diagnose callback only needs a device handle and a vport number, and mlx5_vport carries both and is initialized before any representor driver probes. This change ensures that the representor vnic reporter is properly moved to the eswitch devlink port.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to ensure the representor vnic reporter is properly moved to the eswitch devlink port.
• Verify the Linux kernel version and update if necessary.
• Monitor system logs for any devl_assert_locked() splats during driver unbind.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source metadata indicate a resolved Linux kernel vulnerability. The representor vnic devlink health reporter was created and destroyed along the representor netdev (un)load path, which was not serialized by the devlink instance lock.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.