{"id":"CVE-2026-97966","summary":"octeontx2-pf: reset HTB scheduler topology before freeing queues","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: reset HTB scheduler topology before freeing queues\n\nHTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler\nqueues via otx2_qos_txschq_set_parent_topology(), but teardown freed\nthose queues without clearing TOPOLOGY.  The AF only restores PARENT and\nSCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the\nshared scheduler pool and affect later allocations.\n\nAdd otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero\nTL4 through TL2 TOPOLOGY before each schq is returned to the AF during\nhierarchy teardown and cfg rollback.  Skip the aggregation level (TL1):\nit is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,\nand is not freed back to the AF by nix_txschq_free_one().","modified":"2026-09-26T03:48:27.928630546Z","published":"2026-09-25T10:23:08.543Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97966.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0aa2dd6eaa347c7aab448df0eec0afcfe7489885"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2df186418e17b30b319cf9ff81aad137692ab107"},{"type":"WEB","url":"https://git.kernel.org/stable/c/621c99be42e3f5cb68a6af9480a255218a761c4e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ef39fca8508597fa565cf2be72a884a712fb98af"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97966.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97966"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5e6808b4c68d7882971514ab3279926eb07c8b2d"},{"fixed":"0aa2dd6eaa347c7aab448df0eec0afcfe7489885"},{"fixed":"621c99be42e3f5cb68a6af9480a255218a761c4e"},{"fixed":"2df186418e17b30b319cf9ff81aad137692ab107"},{"fixed":"ef39fca8508597fa565cf2be72a884a712fb98af"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97966.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97966.json"}}],"schema_version":"1.9.0"}