CVE-2026-98948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98948", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:08.043Z", "dateUpdated": "2026-10-23T12:19:08.043Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:08.043Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\n\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\n\nThe issue was found during a review of Wentao Liang's patch referenced\nbelow."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlxsw/spectrum.h", "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c", "drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c"], "versions": [{"version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "lessThan": "41ad5bcf0219aaebf8ffb052c5e8177479330cde", "status": "affected", "versionType": "git"}, {"version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "lessThan": "c8e934287debb29c6ded86b21e49fc72e186d15e", "status": "affected", "versionType": "git"}, {"version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "lessThan": "3938430f0237c59ca08d6a366e7657b2b7f8d0bb", "status": "affected", "versionType": "git"}, {"version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "lessThan": "4eaf1285b5c1e42f80e47f9fe0d391e70418db02", "status": "affected", "versionType": "git"}, {"version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "lessThan": "7ea07afb230f1342ab0f9365edd0aae137f425d3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlxsw/spectrum.h", "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c", "drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41ad5bcf0219aaebf8ffb052c5e8177479330cde"}, {"url": "https://git.kernel.org/stable/c/c8e934287debb29c6ded86b21e49fc72e186d15e"}, {"url": "https://git.kernel.org/stable/c/3938430f0237c59ca08d6a366e7657b2b7f8d0bb"}, {"url": "https://git.kernel.org/stable/c/4eaf1285b5c1e42f80e47f9fe0d391e70418db02"}, {"url": "https://git.kernel.org/stable/c/7ea07afb230f1342ab0f9365edd0aae137f425d3"}], "title": "mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlxsw/spectrum.h", "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c", "drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41ad5bcf0219aaebf8ffb052c5e8177479330cde", "status": "affected", "version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "versionType": "git"}, {"lessThan": "c8e934287debb29c6ded86b21e49fc72e186d15e", "status": "affected", "version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "versionType": "git"}, {"lessThan": "3938430f0237c59ca08d6a366e7657b2b7f8d0bb", "status": "affected", "version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "versionType": "git"}, {"lessThan": "4eaf1285b5c1e42f80e47f9fe0d391e70418db02", "status": "affected", "version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "versionType": "git"}, {"lessThan": "7ea07afb230f1342ab0f9365edd0aae137f425d3", "status": "affected", "version": "fe22f7410527c2077223b5fd0fc0458db912f0db", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlxsw/spectrum.h", "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c", "drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\n\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\n\nThe issue was found during a review of Wentao Liang's patch referenced\nbelow."}], "id": "CVE-2026-98948", "lastModified": "2026-10-23T13:17:15.893", "metrics": {}, "published": "2026-10-23T13:17:15.893", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3938430f0237c59ca08d6a366e7657b2b7f8d0bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41ad5bcf0219aaebf8ffb052c5e8177479330cde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4eaf1285b5c1e42f80e47f9fe0d391e70418db02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ea07afb230f1342ab0f9365edd0aae137f425d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c8e934287debb29c6ded86b21e49fc72e186d15e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: mlxsw: Denial of Service via port range register leak in flower template creation", "id": "2559618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559618"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\nThe issue was found during a review of Wentao Liang's patch referenced\nbelow.", "A flaw was found in the Linux kernel's Mellanox Spectrum switch (mlxsw) driver. This flaw allows a local privileged user to cause a Denial of Service (DoS) by creating network flow classification templates that match port ranges. Because the driver fails to release port range registers allocated during template parsing, these hardware resources leak and become exhausted, preventing subsequent network filtering rules from being configured."], "name": "CVE-2026-98948", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T12:19:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98948\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98948\nhttps://git.kernel.org/stable/c/3938430f0237c59ca08d6a366e7657b2b7f8d0bb\nhttps://git.kernel.org/stable/c/41ad5bcf0219aaebf8ffb052c5e8177479330cde\nhttps://git.kernel.org/stable/c/4eaf1285b5c1e42f80e47f9fe0d391e70418db02\nhttps://git.kernel.org/stable/c/7ea07afb230f1342ab0f9365edd0aae137f425d3\nhttps://git.kernel.org/stable/c/c8e934287debb29c6ded86b21e49fc72e186d15e"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,41ad5bcf0219aaebf8ffb052c5e8177479330cde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,c8e934287debb29c6ded86b21e49fc72e186d15e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,3938430f0237c59ca08d6a366e7657b2b7f8d0bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,4eaf1285b5c1e42f80e47f9fe0d391e70418db02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,7ea07afb230f1342ab0f9365edd0aae137f425d3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,41ad5bcf0219aaebf8ffb052c5e8177479330cde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,c8e934287debb29c6ded86b21e49fc72e186d15e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,3938430f0237c59ca08d6a366e7657b2b7f8d0bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,4eaf1285b5c1e42f80e47f9fe0d391e70418db02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe22f7410527c2077223b5fd0fc0458db912f0db,7ea07afb230f1342ab0f9365edd0aae137f425d3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T14:30:13.797017+00:00", "updated": "2026-10-29T22:00:09.214595+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}