CVE-2026-99029

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99029", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.386Z", "datePublished": "2026-10-23T12:21:21.898Z", "dateUpdated": "2026-10-23T12:21:21.898Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:21:21.898Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: free the matchall entry on destroy\n\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5->mall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\n\nFree the entry after unlinking it.\n\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"], "versions": [{"version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "lessThan": "fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e", "status": "affected", "versionType": "git"}, {"version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "lessThan": "cc7cc5955d22ea90555f09a680d4bf56d4a0c24a", "status": "affected", "versionType": "git"}, {"version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "lessThan": "44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e", "status": "affected", "versionType": "git"}, {"version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "lessThan": "2b82e16d6084cbc651e3c902198f1945408ee1a5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e"}, {"url": "https://git.kernel.org/stable/c/cc7cc5955d22ea90555f09a680d4bf56d4a0c24a"}, {"url": "https://git.kernel.org/stable/c/44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e"}, {"url": "https://git.kernel.org/stable/c/2b82e16d6084cbc651e3c902198f1945408ee1a5"}], "title": "net: sparx5: free the matchall entry on destroy", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e", "status": "affected", "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "versionType": "git"}, {"lessThan": "cc7cc5955d22ea90555f09a680d4bf56d4a0c24a", "status": "affected", "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "versionType": "git"}, {"lessThan": "44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e", "status": "affected", "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "versionType": "git"}, {"lessThan": "2b82e16d6084cbc651e3c902198f1945408ee1a5", "status": "affected", "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: free the matchall entry on destroy\n\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5->mall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\n\nFree the entry after unlinking it.\n\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak."}], "id": "CVE-2026-99029", "lastModified": "2026-10-23T13:17:25.963", "metrics": {}, "published": "2026-10-23T13:17:25.963", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b82e16d6084cbc651e3c902198f1945408ee1a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc7cc5955d22ea90555f09a680d4bf56d4a0c24a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: sparx5: free the matchall entry on destroy", "id": "2559784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559784"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: sparx5: free the matchall entry on destroy\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5->mall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\nFree the entry after unlinking it.\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak.", "A flaw was found in the Linux kernel's Sparx5 network driver. When removing offloaded matchall traffic control filters, the driver unlinks filter entries without freeing the allocated memory. A local user with network administration privileges can exploit this flaw by repeatedly adding and deleting filters to cause kernel memory exhaustion, resulting in a denial of service (DoS)."], "name": "CVE-2026-99029", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99029\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99029\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99029.mbox"], "statement": "This vulnerability is rated as Low severity because triggering the memory leak requires local administrative privileges (CAP_NET_ADMIN) and access to specialized Microchip Sparx5 network switch hardware rarely deployed in standard server environments. Furthermore, the issue only affects kernel availability through memory consumption and does not compromise system confidentiality or data integrity. The vulnerable driver logic is not present in older enterprise releases such as Red Hat Enterprise Linux 8 and 9.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,cc7cc5955d22ea90555f09a680d4bf56d4a0c24a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,2b82e16d6084cbc651e3c902198f1945408ee1a5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,cc7cc5955d22ea90555f09a680d4bf56d4a0c24a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ede4acf045ced70d9b72465e2e968aec71e0a42,2b82e16d6084cbc651e3c902198f1945408ee1a5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:15:07.225146+00:00", "updated": "2026-10-29T14:30:16.097114+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}