CVE-2026-98050

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum ptp: Fix napi gro receive() call from GC workqueue context

Currently mlxsw sp1 ptp ht gc collect() is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an SKB, it calls mlxsw sp1 ptp unmatched finish() -> mlxsw sp1 ptp packet finish(). For ingress packets, this calls mlxsw sp rx listener no mark func(). The end of that function is the following:

skb->protocol = eth type trans(skb, skb->dev); napi gro receive(mlxsw skb cb(skb)->rx md info.napi, skb);

The napi pointer is one that was placed in the SKB control block when the trapped packet was received in the NAPI context. Later, when the GC reaps the unmatched entry (up to MLXSW SP1 PTP HT GC TIMEOUT later), the call to napi gro receive() mutates the NAPI instance's GRO list, which is unsafe if the poll is running concurrently on another CPU.

In mlxsw sp1 ptp ht gc collect(), local bh disable() is called to prevent softirq processing, but this only applies to the local CPU. Additionally, its comment is stale. It states that mlxsw sp1 ptp unmatched finish() invokes netif receive skb(). This has not been accurate since the referenced commit; this patch makes that comment accurate again. mlxsw pci napi devs init() calls netif threaded enable() on the NAPI RX net device without any conditions. The NAPI instance's poll, which may be running concurrent to the GC, is running as an independently-scheduled kthread which may be on a different CPU. The call to local bh disable() does not guard against this.

If a tx-timestamp timeout produces an unmatched entry (which can be easily reproduced by running ptp4l and waiting for a port to reach the UNCALIBRATED/SLAVE state) while the owning NAPI thread is in the middle of a poll on another CPU, both sides mutate the GRO list concurrently, as shown below:

[39.846] port 1 (swp1): MASTER to UNCALIBRATED on RS SLAVE list add corruption. next->prev should be prev (ffff8d620faf4138), but was ffff8d624150f700. (next=ffff8d620faf4138). kernel BUG at lib/list debug.c:29! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 1 UID: 0 PID: 539 Comm: napi/mlxsw rx-0 Not tainted 6.18.48 #1-NixOS PREEMPT(lazy) Hardware name: Mellanox Technologies Ltd. MSN2410/VMOD0001, BIOS 4.6.5 09/13/2018 RIP: 0010: list add valid or report+0x79/0xb0 RSP: 0018:ffffcdf8c0f27c08 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffff8d624150fd00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8d6315d1e540 RBP: ffff8d620faf4070 R08: 0000000000000000 R09: 00000000ffffdfff R10: ffffffffa5c60fe0 R11: ffffcdf8c0f27ab8 R12: 0000000000000003 R13: 000000000000003d R14: 00000000000001bc R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8d636f63f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562689a60c24 CR3: 000000015f224004 CR4: 00000000001726f0 Call Trace: gro receive skb+0xee/0x230 mlxsw sp1 ptp got packet+0x61/0x140 [mlxsw spectrum] mlxsw core skb receive+0xdf/0x1b0 [mlxsw core] mlxsw pci napi poll cq rx+0x780/0x9d0 [mlxsw pci] napi poll+0x31/0x1e0 napi threaded poll loop+0x16b/0x1c0 napi threaded poll+0x71/0xa0 kthread+0xfb/0x260 ret from fork+0x22d/0x260 ret from fork asm+0x1a/0x30 Kernel panic - not syncing: Fatal exception in interrupt

The machinery that leads to this kernel panic has not been changed between 6.18.48 and mainline.

This patch adds an ingress-delivery helper for the PTP packet finish() path that calls netif receive skb() instead of napi gro receive(). netif receive skb(), unlike napi gro receive(), can be called from outside of the NAPI instance's poll context, which can occur at the call site for this path. RX stats accounting and the skb->dev assignment are still preserved; the only change is the delivery call itself.

This removes GR ---truncated---