CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: fix the error path in dpaa2 switch rx()

In case of an error in dpaa2 switch rx(), the dpaa2 switch free fd() function is called in order to free the FD. This is incorrect since the dpaa2 switch free fd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call dev kfree skb().

Fix this by extracting the dma unmap page() from dpaa2 switch build linear skb() directly into the dpaa2 switch rx() function. This allows us to directly use free pages() in case of an error before an SKB was created and kfree skb() afterwards.