CVE-2026-98050 Overview
CVE-2026-98050 is a concurrency flaw in the Linux kernel's mlxsw driver for Mellanox Spectrum switches. The defect lives in the Precision Time Protocol (PTP) handling code at mlxsw_sp1_ptp_ht_gc_collect(). When the garbage-collection workqueue reaps unmatched PTP entries, it calls napi_gro_receive() from outside the owning NAPI poll context. If the NAPI threaded poll executes concurrently on another CPU, both paths mutate the same Generic Receive Offload (GRO) list, corrupting kernel linked lists.
Critical Impact
Concurrent access to the NAPI GRO list produces list corruption that triggers a kernel BUG at lib/list_debug.c:29, resulting in a kernel panic and denial of service on affected switches.
Affected Products
- Linux kernel builds containing the mlxsw_spectrum driver prior to the fix commits
- Mellanox Spectrum (MSN-series) switches running the mlxsw driver with PTP enabled
- Confirmed reproduction on kernel 6.18.48 with threaded NAPI enabled
Discovery Timeline
- 2026-09-25 - CVE-2026-98050 published to the National Vulnerability Database
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-98050
Vulnerability Analysis
The flaw is a race condition between the PTP garbage-collection workqueue and the threaded NAPI receive poll. When a transmit-timestamp timeout leaves a PTP entry unmatched, mlxsw_sp1_ptp_ht_gc_collect() eventually calls mlxsw_sp1_ptp_unmatched_finish(), which routes the SKB through mlxsw_sp_rx_listener_no_mark_func() and finally invokes napi_gro_receive() on the NAPI instance recorded in the SKB control block.
napi_gro_receive() is only safe inside the owning NAPI poll context because it directly mutates that instance's GRO list. The GC workqueue runs in an unrelated kernel context. The existing local_bh_disable() only blocks softirqs on the local CPU and does not protect against the threaded NAPI kthread running on another CPU after mlxsw_pci_napi_devs_init() calls netif_threaded_enable().
Root Cause
The root cause is a Time-of-Check Time-of-Use style concurrency bug combined with stale assumptions in the PTP delivery path. The cached NAPI pointer in the SKB control block is reused from a different execution context, and the delivery API chosen (napi_gro_receive()) requires serialization that the GC workqueue does not provide.
Attack Vector
Triggering the condition requires PTP traffic that leaves unmatched timestamp entries. The reporter reproduced the panic by running ptp4l and waiting for a port to transition to UNCALIBRATED/SLAVE, which created an unmatched entry while the NAPI thread was polling on another CPU. The result is linked-list corruption during gro_receive_skb() and a fatal exception in interrupt context. The call trace shows __list_add_valid_or_report+0x79/0xb0 panicking with list_add corruption. next->prev should be prev.
Exploitation requires adjacent-network access to deliver PTP frames to the switch and does not require authentication. No arbitrary code execution path has been demonstrated; the observed outcome is a kernel panic.
Detection Methods for CVE-2026-98050
Indicators of Compromise
- Kernel panic messages referencing __list_add_valid_or_report, gro_receive_skb, and mlxsw_sp1_ptp_got_packet in the call trace
- list_add corruption warnings naming next->prev mismatches tied to the napi/mlxsw_rx-0 kthread
- Unexpected reboots on Mellanox Spectrum switches coinciding with PTP state transitions such as MASTER to UNCALIBRATED on RS_SLAVE
Detection Strategies
- Collect kernel ring buffer output and kdump crash cores from switches running mlxsw_spectrum; parse for the signature stack trace above
- Alert on repeated ptp4l port state changes correlated with switch reboots or link flaps
- Baseline the kernel versions deployed on network fabric devices and flag hosts still running pre-patch builds
Monitoring Recommendations
- Forward syslog and kernel panic telemetry from switches to a centralized logging platform for correlation
- Monitor PTP service health (ptp4l, phc2sys) for abnormal rates of unmatched timestamp entries
- Track NAPI threaded mode status (/sys/class/net/<iface>/threaded) on mlxsw-backed interfaces
How to Mitigate CVE-2026-98050
Immediate Actions Required
- Inventory Mellanox Spectrum switches running Linux-based network OS images and identify any using the vulnerable mlxsw driver with PTP enabled
- Apply the upstream stable kernel update that routes PTP delivery through netif_receive_skb() instead of napi_gro_receive()
- Schedule maintenance windows to reboot patched switches and validate PTP convergence afterward
Patch Information
The fix adds an ingress-delivery helper for the PTP packet_finish() path that calls netif_receive_skb() in place of napi_gro_receive(). netif_receive_skb() is safe to invoke outside of the NAPI poll context, which eliminates concurrent mutation of the GRO list while preserving RX statistics accounting and the skb->dev assignment. The patch also refreshes the stale comment in mlxsw_sp1_ptp_ht_gc_collect(). Patches are available in kernel.org stable commits 2ac174d, 4375b3d, and 7ddcc46.
Workarounds
- Where PTP is not required, disable PTP timestamping on mlxsw-managed interfaces to prevent entries from entering the unmatched hash table
- Disable threaded NAPI on affected interfaces as a temporary measure to reduce the probability of cross-CPU concurrency, understanding this does not fully eliminate the race
- Restrict adjacent-network sources permitted to deliver PTP traffic to the switch management plane
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
