rootpwn

high · CVSS v3 7.8

CVE-2026-98015

CVE-2026-98015 is a use-after-free vulnerability within the Linux kernel's Mellanox MLX5 E-Switch implementation. The flaw occurs due to a r

Overview

CVE-2026-98015 is a use-after-free vulnerability within the Linux kernel's Mellanox MLX5 E-Switch implementation. The flaw occurs due to a race condition during termtbl (termination table) cleanup, specifically in how reference counts are handled. This could lead to kernel memory corruption and potential system instability.

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free. Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.

Impact

Successful exploitation could lead to a denial of service (DoS) or potentially allow for privilege escalation. Confidentiality, Integrity, and Availability are all potentially impacted. Systems utilizing Mellanox MLX5 E-Switch functionality are at risk, particularly those with high network traffic or concurrent operations on termination tables.

Remediation

Apply the kernel patch provided by your distribution vendor. Ensure kernel modules related to MLX5 E-Switch are updated. Monitor kernel logs for any related errors or crashes after patching.

Risk context

This vulnerability is rated as High severity (CVSS v3: 7.8). While an EPSS score is not available, the potential for kernel-level impact warrants prompt attention. Prioritize patching based on the prevalence of MLX5 E-Switch usage within your environment.

Affected products

  • Linux Kernel (net/mlx5)
  • Mellanox MLX5 E-Switch

Scores

Severity
high
CVSS v2
7.2
CVSS v3
7.8
CVSS v4
—
EPSS
—

linux kernel mlx5 e-switch use-after-free memory corruption kernel patch race condition

← All CVEs

Related CVEs

high

CVE-2026-98026

This vulnerability affects the Linux kernel's bridge multicast handling. An improper RCU usage can lead to premature freeing of port group structures, potentially causing memory corruption or crashes. The fix converts mglist to RCU and corrects initialization order.

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis