« Volver al listado

CVE-2026-98015

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free.

Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98015",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "e3ee194a790896fa92fea20b5385a354be2f2c12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "92f581cac93a71723456ac79ef54d9f60a251b42",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "a5833fdf53350b8b95a558fcf0056ddb1c0fe154",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "304ea40ef4561671503c36e47da44a0a31b71e36",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "e393789e92310d7c66f57c876101779c90816a12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "18b2969073879b9cce24e1a78b118bdad54518d1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10caabdaad5ace85577a453da97d1f8d3b944427",
              "lessThan": "7ee07f601f8f507c9faf25c68a49396ab8950596",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:29.927",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt->ref_count after termtbl_mutex has been released.  Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt->ref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex.  The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree."
    }
  ],
  "lastModified": "2026-10-03T11:18:24.657",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}