CVE-2026-98015net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free. Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 10caabdaad5ace85577a453da97d1f8d3b944427 before e3ee194a790896fa92fea20b5385a354be2f2c12; from 10caabdaad5ace85577a453da97d1f8d3b944427 before b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797; from 10caabdaad5ace85577a453da97d1f8d3b944427 before 92f581cac93a71723456ac79ef54d9f60a251b42; from 10caabdaad5ace85577a453da97d1f8d3b944427 before a5833fdf53350b8b95a558fcf0056ddb1c0fe154; from 10caabdaad5ace85577a453da97d1f8d3b944427 before 304ea40ef4561671503c36e47da44a0a31b71e36; from 10caabdaad5ace85577a453da97d1f8d3b944427 before e393789e92310d7c66f57c876101779c90816a12; from 10caabdaad5ace85577a453da97d1f8d3b944427 before 18b2969073879b9cce24e1a78b118bdad54518d1; 10caabdaad5ace85577a453da97d1f8d3b944427 builds before 7ee07f601f8f507c9faf25c68a49396ab8950596 | CNA record |
References
- https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12
- https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797
- https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42
- https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154
- https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36
- https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12
- https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1
- https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.