---
id: CVE-2026-98911
title: 'dpaa2-switch: fix the error path in dpaa2_switch_rx()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpaa2-switch: fix the error path in dpaa2_switch_rx()

  In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
  function is called in order to free the FD. …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    791068c962469af0090e1a1ee63657fb9eef40db
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    ee54f8d7e642c44cfcc2dcb390b4c50e145d81b8
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    259ad6093204b999d41e7e6d0ad90ef9a71a44ab
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f4ceb8e3d6d5becb4cda7a7098a8638e18c835a1
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    fa232b4496cb59503ae5108c756cbe10e59b0bc3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d
  - Linux < 5.15.222
  - Linux < 6.1.189
  - Linux < 6.6.158
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:09:31.202Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98911'
references:
  - url: 'https://git.kernel.org/stable/c/791068c962469af0090e1a1ee63657fb9eef40db'
  - url: 'https://git.kernel.org/stable/c/ee54f8d7e642c44cfcc2dcb390b4c50e145d81b8'
  - url: 'https://git.kernel.org/stable/c/259ad6093204b999d41e7e6d0ad90ef9a71a44ab'
  - url: 'https://git.kernel.org/stable/c/f4ceb8e3d6d5becb4cda7a7098a8638e18c835a1'
  - url: 'https://git.kernel.org/stable/c/fa232b4496cb59503ae5108c756cbe10e59b0bc3'
  - url: 'https://git.kernel.org/stable/c/74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11289
ingestedAt: '2026-10-23T13:24:55.572Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: fix the error path in dpaa2_switch_rx()

In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
function is called in order to free the FD. This is incorrect since the
dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,
meaning that it expects in the software annotation area of the FD data
to find a valid skb pointer on which to call dev_kfree_skb().

Fix this by extracting the dma_unmap_page() from
dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()
function. This allows us to directly use free_pages() in case of an
error before an SKB was created and kfree_skb() afterwards.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 791068c962469af0090e1a1ee63657fb9eef40db`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ee54f8d7e642c44cfcc2dcb390b4c50e145d81b8`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 259ad6093204b999d41e7e6d0ad90ef9a71a44ab`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f4ceb8e3d6d5becb4cda7a7098a8638e18c835a1`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fa232b4496cb59503ae5108c756cbe10e59b0bc3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d`
- `Linux < 5.15.222`
- `Linux < 6.1.189`
- `Linux < 6.6.158`
- `Linux < 6.12.111`
- `Linux < 6.18.53`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.