---
id: CVE-2026-97966
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-pf: reset HTB scheduler topology before freeing queues

  HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler
  queues via otx2_qos_txschq_set_pa…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-pf: reset HTB scheduler topology before freeing queues

  HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler
  queues via otx2_qos_txschq_set_pa…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e6808b4c68d7882971514ab3279926eb07c8b2d <
    0aa2dd6eaa347c7aab448df0eec0afcfe7489885
  - >-
    Linux >= 5e6808b4c68d7882971514ab3279926eb07c8b2d <
    621c99be42e3f5cb68a6af9480a255218a761c4e
  - >-
    Linux >= 5e6808b4c68d7882971514ab3279926eb07c8b2d <
    2df186418e17b30b319cf9ff81aad137692ab107
  - >-
    Linux >= 5e6808b4c68d7882971514ab3279926eb07c8b2d <
    ef39fca8508597fa565cf2be72a884a712fb98af
  - Linux 6.5
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:24.413'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97966'
references:
  - url: 'https://git.kernel.org/stable/c/0aa2dd6eaa347c7aab448df0eec0afcfe7489885'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2df186418e17b30b319cf9ff81aad137692ab107'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/621c99be42e3f5cb68a6af9480a255218a761c4e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef39fca8508597fa565cf2be72a884a712fb98af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.873Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: reset HTB scheduler topology before freeing queues

HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler
queues via otx2_qos_txschq_set_parent_topology(), but teardown freed
those queues without clearing TOPOLOGY.  The AF only restores PARENT and
SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the
shared scheduler pool and affect later allocations.

Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero
TL4 through TL2 TOPOLOGY before each schq is returned to the AF during
hierarchy teardown and cfg rollback.  Skip the aggregation level (TL1):
it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,
and is not freed back to the AF by nix_txschq_free_one().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.