In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an…
CVE-2026-98911 · GHSA-2gxg-jvpv-v5rf · EUVD-2026-108867 · published 23 Oct 2026
How serious is it
- Severity: high, CVSS score 7.5 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-98911?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: patch: 7.2
- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <791068c962469af0090e1a1ee63657fb9eef40db
- Linux Linux: 0 <6.12.111
- Linux Linux: patch: 6.6.158
- Linux Linux: 0 <6.18.53
- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <259ad6093204b999d41e7e6d0ad90ef9a71a44ab
- Linux Linux: patch: 6.18.53
- Linux Linux: patch: 5.15.222
- Linux Linux: 0 <6.6.158
- Linux Linux: 0 <6.1.189
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: fix the error path in dpaa2_switch_rx()
In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
function is called in order to free the FD. This is incorrect since the
dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,
meaning that it expects in the software annotation area of the FD data
to find a valid skb pointer on which to call dev_kfree_skb().
Fix this by extracting the dma_unmap_page() from
dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()
function. This allows us to directly use free_pages() in case of an
error before an SKB was created and kfree_skb() afterwards.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/791068c962469af0090e1a1ee63657fb9eef40db
- git.kernel.org/stable/c/ee54f8d7e642c44cfcc2dcb390b4c50e145d81b8
- git.kernel.org/stable/c/259ad6093204b999d41e7e6d0ad90ef9a71a44ab
- git.kernel.org/stable/c/f4ceb8e3d6d5becb4cda7a7098a8638e18c835a1
- git.kernel.org/stable/c/fa232b4496cb59503ae5108c756cbe10e59b0bc3
- git.kernel.org/stable/c/74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON