CVE-2026-98498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98498", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.353Z", "datePublished": "2026-10-18T15:16:30.116Z", "dateUpdated": "2026-10-19T09:20:36.589Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:36.589Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()\n\nWhen the reverse entry is found but its counter is already being\nreleased, refcount_inc_not_zero() fails and the reference taken by\nmlx5_tc_ct_entry_get() is never dropped before falling through to\ncreate_counter. Drop it so the reverse entry is not kept alive forever\nby a shared counter lookup that did not use it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"], "versions": [{"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "598daa5f95883f881a54967da40ce0fdfc1fdaa8", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "79a3257280a335bbebbcd10d3895e8468bdcd6ae", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "c45c997d0c27359b502587897f775c5a277f0bd4", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "288721013605b4e0304e10f6a087b77f71cfad11", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "60eab87d0a798070bf5a856b1d9e5785ce92da53", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "99d8dc51663747078c031acac32edc6d90c8f1f7", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "1f13989a0704bd98cab09f9bee63e2c8a98ad4dd", "status": "affected", "versionType": "git"}, {"version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "lessThan": "0bf6bb567f0edaa771e7dd208ef98da50e6a4485", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/598daa5f95883f881a54967da40ce0fdfc1fdaa8"}, {"url": "https://git.kernel.org/stable/c/79a3257280a335bbebbcd10d3895e8468bdcd6ae"}, {"url": "https://git.kernel.org/stable/c/c45c997d0c27359b502587897f775c5a277f0bd4"}, {"url": "https://git.kernel.org/stable/c/288721013605b4e0304e10f6a087b77f71cfad11"}, {"url": "https://git.kernel.org/stable/c/60eab87d0a798070bf5a856b1d9e5785ce92da53"}, {"url": "https://git.kernel.org/stable/c/99d8dc51663747078c031acac32edc6d90c8f1f7"}, {"url": "https://git.kernel.org/stable/c/1f13989a0704bd98cab09f9bee63e2c8a98ad4dd"}, {"url": "https://git.kernel.org/stable/c/0bf6bb567f0edaa771e7dd208ef98da50e6a4485"}], "title": "net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "598daa5f95883f881a54967da40ce0fdfc1fdaa8", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "79a3257280a335bbebbcd10d3895e8468bdcd6ae", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "c45c997d0c27359b502587897f775c5a277f0bd4", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "288721013605b4e0304e10f6a087b77f71cfad11", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "60eab87d0a798070bf5a856b1d9e5785ce92da53", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "99d8dc51663747078c031acac32edc6d90c8f1f7", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "1f13989a0704bd98cab09f9bee63e2c8a98ad4dd", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}, {"lessThan": "0bf6bb567f0edaa771e7dd208ef98da50e6a4485", "status": "affected", "version": "1edae2335adfa7006853e8b427f0c7c3f46b51dd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()\n\nWhen the reverse entry is found but its counter is already being\nreleased, refcount_inc_not_zero() fails and the reference taken by\nmlx5_tc_ct_entry_get() is never dropped before falling through to\ncreate_counter. Drop it so the reverse entry is not kept alive forever\nby a shared counter lookup that did not use it."}], "id": "CVE-2026-98498", "lastModified": "2026-10-19T10:19:02.553", "metrics": {}, "published": "2026-10-18T16:17:00.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0bf6bb567f0edaa771e7dd208ef98da50e6a4485"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f13989a0704bd98cab09f9bee63e2c8a98ad4dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/288721013605b4e0304e10f6a087b77f71cfad11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/598daa5f95883f881a54967da40ce0fdfc1fdaa8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60eab87d0a798070bf5a856b1d9e5785ce92da53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79a3257280a335bbebbcd10d3895e8468bdcd6ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99d8dc51663747078c031acac32edc6d90c8f1f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c45c997d0c27359b502587897f775c5a277f0bd4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()", "id": "2554827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554827"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()\nWhen the reverse entry is found but its counter is already being\nreleased, refcount_inc_not_zero() fails and the reference taken by\nmlx5_tc_ct_entry_get() is never dropped before falling through to\ncreate_counter. Drop it so the reverse entry is not kept alive forever\nby a shared counter lookup that did not use it.", "A flaw was found in the Linux kernel's mlx5 network driver. When handling shared connection tracking counters, the driver fails to properly release an entry's reference count if the associated counter is in the process of being released. This reference count leak prevents the reverse entry from being freed, which can cause resource exhaustion and lead to a Denial of Service (DoS)."], "name": "CVE-2026-98498", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98498\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98498\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98498.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,598daa5f95883f881a54967da40ce0fdfc1fdaa8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,79a3257280a335bbebbcd10d3895e8468bdcd6ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,c45c997d0c27359b502587897f775c5a277f0bd4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,288721013605b4e0304e10f6a087b77f71cfad11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,60eab87d0a798070bf5a856b1d9e5785ce92da53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,99d8dc51663747078c031acac32edc6d90c8f1f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,1f13989a0704bd98cab09f9bee63e2c8a98ad4dd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1edae2335adfa7006853e8b427f0c7c3f46b51dd,0bf6bb567f0edaa771e7dd208ef98da50e6a4485)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:45:06.374929+00:00", "updated": "2026-10-22T22:45:13.860523+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772", "CWE-911"]}