CVE-2026-98619 Linux CVE debrief

Who should care

Linux kernel maintainers, ops-locked driver developers, and system administrators responsible for configuring ethtool self-tests should verify and apply patches, review configurations, and monitor for potential issues. Affected operators, platforms, vulnerability-management, and security teams should also be aware of the vulnerability and its potential impacts.

Why it matters

A vulnerability in the Linux kernel's ethtool self-test functionality can cause an interface to be brought down and back up without proper locking, leading to a potential use-after-free condition. Linux kernel maintainers, ops-locked driver developers, and system administrators responsible for configuring ethtool self-tests should verify and apply patches, review configurations, and monitor for potential issues.

• Potential use-after-free conditions may occur due to improper locking
• Verification of ethtool self-test configurations is necessary for ops-locked drivers
• Monitoring for potential issues is recommended

Technical summary

The Linux kernel's ethtool self-test functionality is vulnerable to a use-after-free condition due to improper locking. The ethtool IOCTL path has become rtnl-optional for ops-locked drivers, causing the self-test to tear down the device without rtnl_lock. This can be reproduced deterministically with lockdep and trips ASSERT_RTNL() in __dev_close_many() / __dev_open(). The vulnerability affects ops-locked drivers like fbnic and bnxt, which require rtnl_lock for their offline self-test functionality. An opt-in bit has been added for drivers whose self-test needs rtnl_lock.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers
• Verify ethtool self-test configurations for ops-locked drivers
• Monitor for potential use-after-free conditions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue arises from the ethtool self-test, a legacy ioctl-only command, which requires rtnl_lock for certain operations. An opt-in bit has been added for drivers whose self-test needs rtnl_lock, and it has been set on ops-locked drivers like fbnic and bnxt.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.