CVE-2026-98015
Received Received - Intake

Use-After-Free in Linux Kernel mlx5 E-Switch

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free. Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98015
EUVD
EUVD-2026-86668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's mlx5 E-Switch driver. It occurs when two concurrent processes access the same mlx5_termtbl_handle, leading to a race condition where one process frees memory while another still tries to access it after the mutex is released.

Detection Guidance

This vulnerability is specific to the Linux kernel's mlx5 E-Switch module and requires kernel-level detection. There are no direct commands to detect this use-after-free issue as it requires analyzing kernel memory states. Monitoring kernel logs for crashes or errors related to mlx5_eswitch_termtbl_put may indicate exploitation. Ensure your kernel is updated to a patched version.

Impact Analysis

This could cause system crashes, data corruption, or privilege escalation if exploited. Systems using affected Linux kernel versions with mlx5 E-Switch functionality may be vulnerable to denial-of-service or arbitrary code execution.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution that includes the fix for CVE-2026-98015. If immediate patching is not possible, consider disabling the mlx5 E-Switch module if not required. Monitor vendor advisories for additional guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart