CVE-2026-97966

A flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver. When tearing down Hierarchical Token Bucket (HTB) quality-of-service queues, the driver fails to clear hardware scheduler topology configurations before returning queues to the shared pool. A local user with network configuration privileges can exploit this flaw by resetting traffic control configurations, allowing stale priority settings to persist. This residual state can corrupt subsequent scheduler allocations, potentially leading to improper traffic prioritization or a Denial of Service (DoS).

A moderate-severity flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver (octeontx2-pf) as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and RHEL CoreOS 9-based OpenShift Container Platform releases. When a Hierarchical Token Bucket (HTB) quality-of-service queue hierarchy is torn down or its configuration is rolled back, the driver returns hardware scheduler queues to the shared scheduler pool without clearing their scheduler topology settings, so stale priority configuration (PRIO_ANCHOR/RR_PRIO) can survive and be inherited by later queue allocations. On a system with OCTEON TX2 hardware, a local user with network configuration privileges (CAP_NET_ADMIN) could exploit this flaw by configuring and then resetting traffic control offload on the interface, corrupting subsequent scheduler allocations and potentially causing improper traffic prioritization or a denial of service of network transmission. Confidentiality and integrity of data are not impacted. Earlier Red Hat Enterprise Linux releases (including RHEL 6, 7, and 8, and earlier RHEL 9 streams) are not affected because the HTB offload support that contains this flaw is not present in those kernels. The fix is currently deferred for the affected streams; the residual risk is limited because exploitation requires local access with network administration privileges on OCTEON TX2 hardware, and the worst-case outcome is disruption of network traffic scheduling rather than memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.