CVE-2026-98015

Received Received - Intake

Use-After-Free in Linux Kernel mlx5 E-Switch

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free. Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98015

EUVD

EUVD-2026-86668

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's mlx5 E-Switch driver. It occurs when two concurrent processes access the same mlx5_termtbl_handle, leading to a race condition where one process frees memory while another still tries to access it after the mutex is released.

Detection Guidance

This vulnerability is specific to the Linux kernel's mlx5 E-Switch module and requires kernel-level detection. There are no direct commands to detect this use-after-free issue as it requires analyzing kernel memory states. Monitoring kernel logs for crashes or errors related to mlx5_eswitch_termtbl_put may indicate exploitation. Ensure your kernel is updated to a patched version.

Impact Analysis

This could cause system crashes, data corruption, or privilege escalation if exploited. Systems using affected Linux kernel versions with mlx5 E-Switch functionality may be vulnerable to denial-of-service or arbitrary code execution.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's mlx5 E-Switch subsystem. It does not directly relate to data privacy, access control, or audit logging requirements in standards like GDPR or HIPAA. The issue is a memory management bug that could lead to system instability or crashes, but there is no evidence it impacts compliance with these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution that includes the fix for CVE-2026-98015. If immediate patching is not possible, consider disabling the mlx5 E-Switch module if not required. Monitor vendor advisories for additional guidance.

Hi! I’m here to help you understand CVE-2026-98015. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70