Executive brief
The Sparx5 Ethernet switch driver in the Linux kernel contained a bug where mutex locking operations were being called from an atomic (interrupt-disabled) context during network device configuration. This could cause kernel hangs or crashes when setting multicast MAC addresses on network interfaces. The fix moves the operation to a deferred work queue to ensure it runs in a safe process context.
Technical details
A sleep-in-atomic-context bug exists in sparx5_set_rx_mode(), which runs with netif_addr_lock_bh held (in a software interrupt context). The function called sparx5_mact_learn()/sparx5_mact_forget() to update the MAC address table, but these functions acquire sparx5->lock (a mutex) and then poll registers using readx_poll_timeout(), both of which can sleep—forbidden in atomic context. The fix converts the driver to use the new .ndo_set_rx_mode_async callback introduced in Linux 5.17+, which invokes the handler from process context, allowing safe mutex and sleep operations. The vulnerable code path is triggered when opening a network interface or modifying multicast addresses. The fix is available in upstream Linux and distributed via stable kernels.
Affected products
- Linux Linux kernel Affected versions depend on stable backports; original bug present in kernels with sparx5 driver support (v5.15 and later without fix)
Timeline
- 2026-09-17: disclosed: CVE-2026-90098 published on NVD
- 2026-08-22: patched: Upstream patch b62793a7baeea9cf20209c9fd2e333311aaf3b8d committed
- 2026-09-14: patched: Backported to stable kernels