Concurrent NAPI Context Vulnerability in Mellanox Spectrum Product by Mellanox Technologies

CVE-2026-98050

What is CVE-2026-98050?

A concurrency vulnerability exists in the PTP packet processing of the Mellanox Spectrum products within the Linux kernel. Specifically, the mlxsw_sp1_ptp_ht_gc_collect() function may invoke napi_gro_receive() while modifications to the NAPI instance’s GRO list are being made concurrently by separate CPU threads. The introduction of these concurrent operations can lead to a kernel panic due to corruption in the SKB list structure, notably during the garbage collection of unmatched PTP entries. This situation arises frequently in heavily-utilized environments and can compromise system stability and reliability, necessitating immediate attention and remediation.

References