CVE-2026-98967

In the Linux kernel, the following vulnerability has been resolved:

cxgb4/ch ktls: disable softirqs around tid list erases

chcr ktls cpl act open rpl() inserts into tid list from the receive path using xa insert bh(). The array is shared by the adapter's connections and initialized with XA FLAGS LOCK BH. However, chcr ktls dev del() and the chcr ktls dev add() error path use xa erase(), which takes the XArray lock without disabling softirqs.

When cleanup runs with softirqs enabled, a receive softirq for another connection on the same CPU can interrupt the erase and spin on the lock held by the interrupted task. Use xa erase bh() at both sites to match the insertion path.