CVE-2026-98619

In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: keep rtnl lock for the ioctl self test

An offline self test that brings the interface down and back up with netif close() / netif open() requires rtnl lock for both. Since the ethtool IOCTL path became rtnl-optional for ops-locked drivers, the ETHTOOL TEST ioctl runs holding only the netdev instance lock, so on an ops-locked driver the self test now tears the device down without rtnl lock.

With lockdep this reproduces deterministically on every offline self test on such a driver; note the sole lock held is the instance lock, not rtnl:

WARNING: suspicious RCU usage net/core/netpoll.c:207 suspicious rcu dereference protected() usage! 1 lock held by ethtool/107: #0: (&dev->lock){+.+.}, at: dev ethtool Call Trace: netpoll poll disable dev close many netif close many netif close fbnic self test dev ethtool locked dev ethtool dev ioctl sock ioctl x64 sys ioctl

Without lockdep the same condition trips ASSERT RTNL() in dev close many() / dev open(); that check only samples the global rtnl state, so it can be masked by a concurrent rtnl holder, but the device is still being reconfigured without the lock it requires.

The ethtool self test is a legacy ioctl-only command, so an ETHTOOL TEST case is only needed on the ioctl path. Add an opt-in bit for drivers whose self test needs rtnl lock and set it on the ops-locked drivers whose offline self test tears the interface down and up: