CVE-2026-98498
Received Received - Intake

Memory Leak in Linux Kernel MLX5 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98498
EUVD
EUVD-2026-103738

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd
Linux Linux 5.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the net/mlx5 driver. It involves a reference leak in the mlx5_tc_ct_shared_counter_get() function. When a reverse entry is found but its counter is already being released, the reference taken by mlx5_tc_ct_entry_get() is not properly dropped, causing the reverse entry to remain alive indefinitely.

Impact Analysis

This vulnerability could lead to resource exhaustion in the Linux kernel, potentially causing system instability or crashes. It may also allow unauthorized access or manipulation of network traffic if exploited by an attacker with local access.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the reference leak in mlx5_tc_ct_shared_counter_get().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart