{"id":"CVE-2026-98015","revision":"eb723ef580e04dd38783ae70b3a9ea4f","records":[{"revision":"eb723ef580e04dd38783ae70b3a9ea4f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98015","aliases":[],"title":"net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt->ref_count after termtbl_mutex has been released.  Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt->ref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex.  The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree.","state":0,"publishedAt":"2026-09-25T10:23:37.724+00:00","modifiedAt":"2026-10-19T09:12:20.637+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"e3ee194a790896fa92fea20b5385a354be2f2c12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"92f581cac93a71723456ac79ef54d9f60a251b42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"a5833fdf53350b8b95a558fcf0056ddb1c0fe154\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"304ea40ef4561671503c36e47da44a0a31b71e36\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"e393789e92310d7c66f57c876101779c90816a12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"18b2969073879b9cce24e1a78b118bdad54518d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10caabdaad5ace85577a453da97d1f8d3b944427\",\n                            \"lessThan\": \"7ee07f601f8f507c9faf25c68a49396ab8950596\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12","https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797","https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42","https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154","https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36","https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12","https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1","https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98015","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98015","identifiers":["CVE-2026-98015"]},"retained":false,"historicalAffected":[]}],"coverage":[]}