CVE-2026-98615: Linux Kernel Mailbox Flush Vulnerability

CVE-2026-98615 Overview

CVE-2026-98615 affects the Linux kernel fbnic Ethernet driver. The flaw sits in the firmware (FW) mailbox teardown path, where fbnic_mbx_reset_desc_ring() writes AW_CFG with FLUSH set while clearing BME (Bus Master Enable) and other bits. Clearing BME stops host-bound writes but leaves staged requests parked in the PUL write pipeline. As a result, the firmware waits indefinitely for a flush completion that never arrives. The fix introduces an AW_FLUSH_MODE definition and sets it together with AW_FLUSH so the staged writes drain on their own.

Critical Impact
The driver can hang during FW mailbox teardown because outstanding writes never drain, blocking device reset and shutdown flows on systems using the Meta fbnic NIC.

Affected Products

Linux kernel builds including the fbnic Ethernet driver (drivers/net/ethernet/meta/fbnic)
Stable kernel branches patched by commits 8947f13e, 8a052cd4, a969db65, and ed4163f6
Systems using Meta fbnic network interface controllers

Discovery Timeline

2026-10-18 - CVE-2026-98615 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98615

Vulnerability Analysis

The fbnic driver manages a firmware mailbox used for host-device control communication. During teardown of the Rx descriptor ring, fbnic_mbx_reset_desc_ring() issues a plain store to the AW_CFG register with only the FLUSH bit set. Every other bit, including BME, is cleared in the same store.

Clearing BME immediately halts host-directed writes from the device. However, requests already staged inside the PUL write pipeline are not drained by this action. The FLUSH bit alone does not terminate those outstanding requests on the write path. The firmware stalls waiting for a flush completion that never fires, leaving the mailbox teardown blocked.

The read path is not affected because AR_FLUSH by itself terminates outstanding reads, and AR_CFG has no equivalent mode bit.

Root Cause

The root cause is an incorrect register programming sequence during mailbox teardown. The driver missed setting a FLUSH_MODE companion bit required to drain staged writes once BME is cleared. Without FLUSH_MODE, the device has no instruction to flush the pipeline internally, so the pending writes remain in-flight indefinitely.

Attack Vector

This issue is a reliability and denial-of-service class defect in a kernel network driver rather than a remotely reachable code execution flaw. It manifests during device teardown, reset, or module unload paths on hosts equipped with Meta fbnic hardware. No proof-of-concept exploit, CISA KEV listing, or evidence of exploitation in the wild is available for CVE-2026-98615. See the upstream commits for the technical fix details.

// No verified exploit code available for CVE-2026-98615.
// Refer to the upstream kernel commits for the register-level fix:
// - 8947f13e436a4ff5eed9f8f019b2865a07af4bb2
// - 8a052cd4b2caee1f90cf0e3874377066939c90e7
// - a969db6548a1b046cd1423701f5f9c3f5794e90d
// - ed4163f6ba9b52bfd6216d5215ee7b8eb5072411

Detection Methods for CVE-2026-98615

Indicators of Compromise

Kernel log entries from the fbnic driver indicating mailbox flush timeouts during device teardown or reset
Processes blocked in fbnic_mbx_reset_desc_ring() or related mailbox teardown functions visible in /proc/<pid>/stack
Hung-task warnings referencing the fbnic driver in dmesg

Detection Strategies

Enumerate running kernel versions across the fleet and cross-reference against the patched stable commits listed in the upstream references.
Inventory hosts with Meta fbnic NICs by inspecting lspci output and loaded driver modules.
Correlate NIC reset failures and link-flap events with kernel versions that predate the fix.

Monitoring Recommendations

Forward dmesg and journald kernel subsystem logs to a central log store and alert on fbnic mailbox or hung-task messages.
Track planned and unplanned NIC resets on affected hardware to catch repeating teardown failures.
Monitor kernel package versions through configuration management to confirm patch rollout.

How to Mitigate CVE-2026-98615

Immediate Actions Required

Identify hosts running Linux kernels with the unpatched fbnic driver and schedule updates to a fixed stable release.
Apply the vendor-provided kernel update that includes the AW_FLUSH_MODE fix for the mailbox teardown path.
On impacted hosts, avoid non-essential driver reloads and NIC resets until the kernel is patched.

Patch Information

The fix is distributed across the upstream Linux stable tree in commits Linux Kernel Commit 8947f13, Linux Kernel Commit 8a052cd, Linux Kernel Commit a969db6, and Linux Kernel Commit ed4163f6. The patch adds the FLUSH_MODE definition and sets both FLUSH and FLUSH_MODE in AW_CFG, allowing staged writes to drain while BME remains cleared. BME and TLP attributes are restored later in fbnic_mbx_init_desc_ring() once outstanding writes complete.

Workarounds

No reliable software workaround exists; the register programming defect is inside the driver teardown path and requires the kernel patch.
Where patching cannot occur immediately, minimize operations that trigger mailbox teardown, including driver unload, device reset, and suspend/resume cycles on affected NICs.

bash

# Verify current kernel version and loaded fbnic driver on affected hosts
uname -r
lsmod | grep fbnic
lspci -k | grep -A3 -i meta

# After applying the vendor kernel update, reboot and confirm the new version
sudo reboot
uname -r