CVE-2026-72409: net: mvneta: re-enable percpu interrupt on resume

CVE-2026-72409: net: mvneta: re-enable percpu interrupt on resume

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: mvneta: re-enable percpu interrupt on resume

On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu
IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls
disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules
NAPI poll, which calls enable_percpu_irq() on completion to unmask.

If suspend occurs while NAPI poll is pending (between
disable_percpu_irq in the ISR and enable_percpu_irq in poll
completion), the interrupt is never re-enabled:

  1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule()
     => MPIC masked, percpu_enabled cpumask bit cleared
  2. NAPI poll does not complete before suspend proceeds
     (on PREEMPT_RT this is highly likely since softirqs run in
     ksoftirqd which gets frozen; on non-RT it can happen when
     softirq processing is deferred to ksoftirqd)
  3. mvneta_stop_dev => napi_disable(): cancels the pending poll
     without executing the completion path
  4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC
     (already masked, but records IRQS_SUSPENDED)
  5. Resume: mpic_resume checks irq_percpu_is_enabled() => false
     (bit was cleared in step 1) => skips unmask
  6. mvneta_start_dev only restores device-level INTR_NEW_MASK,
     does not touch the MPIC per-CPU mask

Result: MPIC per-CPU interrupt stays masked permanently. The NIC
generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never
receives them, causing complete loss of network connectivity.

Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path
to unconditionally unmask the MPIC per-CPU interrupt regardless of
pre-suspend state.

The Linux kernel CVE team has assigned CVE-2026-72409 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 5.10.261 with commit bf88cd3b649bc3e638f1e8a77649581852747a68
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 5.15.212 with commit 8c7a489aa71d2693752b2e794a68bf672d16c829
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 6.1.178 with commit 82c13027ed283b856017adee970dbfdffce5c6b8
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 6.6.145 with commit be626ac1faadd49c2cead9f9cd06ba8752d81563
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 6.12.97 with commit 1cc312dc8bc78fa24c80d5bc193dbf5b57a99cc6
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 6.18.40 with commit b84dd48f9da1eb132bdc06a944423cd5a1641ef1
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 7.1.5 with commit 5bdb33ff6e58bdc43632e98b30723eb65352d671
	Issue introduced in 4.4 with commit 12bb03b436dad56692e9a103ed26156156bef5d2 and fixed in 7.2-rc1 with commit fd398d6480987e4c84fff0aaab6b9d6642a93343

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72409
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/marvell/mvneta.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bf88cd3b649bc3e638f1e8a77649581852747a68
	https://git.kernel.org/stable/c/8c7a489aa71d2693752b2e794a68bf672d16c829
	https://git.kernel.org/stable/c/82c13027ed283b856017adee970dbfdffce5c6b8
	https://git.kernel.org/stable/c/be626ac1faadd49c2cead9f9cd06ba8752d81563
	https://git.kernel.org/stable/c/1cc312dc8bc78fa24c80d5bc193dbf5b57a99cc6
	https://git.kernel.org/stable/c/b84dd48f9da1eb132bdc06a944423cd5a1641ef1
	https://git.kernel.org/stable/c/5bdb33ff6e58bdc43632e98b30723eb65352d671
	https://git.kernel.org/stable/c/fd398d6480987e4c84fff0aaab6b9d6642a93343