CVE-2026-98014 - Vulnerability Details

- net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead
of esw_vport_change_handle_locked() so vport->allmulti_rule is
NULL before the change handler observes it.

During FW-fatal recovery the disable runs while dev->state ==
INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode()
fails and returns early, leaving vport->allmulti_rule intact, so
esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries
to vport->mc_list whose flow rules are then installed in the FDB
by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the
FDB with those refs still held, corrupting the sub-tree and
leaving dangling flow_rule pointers in vport->mc_list.

Two-stage failure on `echo 1 > /sys/bus/pci/devices/<bdf>/reset`:

refcount_t: underflow; use-after-free.
tree_put_node+0xef/0x110 [mlx5_core]
clean_tree+0x44/0xd0 [mlx5_core] (x5)
mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core]
mlx5_unload+0x65/0xd0 [mlx5_core]
... mlx5_health_try_recover

BUG: unable to handle page fault for address: 0000000003000055
down_write+0x1c/0x60
mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core]
esw_del_mc_addr+0x7b/0x170 [mlx5_core]
esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core]
esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core]
mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core]
... mlx5_load ... mlx5_health_try_recover

esw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule
via its local state machine even when the FW del fails. With the
rule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change
handler closes, no rules are installed during disable, and the
reload starts with a clean mc_list.

Published: 2026-09-25

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux mlx5 e‑switch driver causes the virtual port disable routine to run the multicast update function before the vport change handler cleans the all‑multicast rule field. When the device is in a firmware‑fatal‑recovery state and the multicast rule is still present, the driver mistakenly adds duplicate multicast entries to the vport’s mc_list and later deletes the legacy multicast table while those entries are still referenced. The result is an underflow of a reference count and a dangling pointer that can trigger a kernel panic.

Affected Systems

All Linux kernel builds that contain the mlx5 e‑switch driver before the CVE‑2026‑98014 fix are impacted. No specific kernel versions are enumerated in the data, so any distribution kernel that ships the driver and has not applied the patch is vulnerable.

Risk and Exploitability

The CVSS score is 7.0; EPSS score is < 1%; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that triggering the failure requires local privileged access, which could limit exploitation to users who have administrative control over the device. The defect can be triggered by resetting the device or during a firmware fatal recovery.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4df1f2d36bdc9a368650bf14b9097c555e95f71d`	affected	< 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9
`63546395a0e6ac264f78f65218086ce6014b4494`	affected	< 2196f9d3358b00fcb28835a5fde14071f51ecb96
`922f56e9a795d6f3dd72d3428ebdd7ee040fa855`	affected	< 5a2b87dfceccf9065157a14a599d395c2b6281b8
`922f56e9a795d6f3dd72d3428ebdd7ee040fa855`	affected	< 69904608e25e8ba58111aadd9210892cf3876201
`922f56e9a795d6f3dd72d3428ebdd7ee040fa855`	affected	< 72cfcb79026cffb6490f5044153a841d360b0cfc
`922f56e9a795d6f3dd72d3428ebdd7ee040fa855`	affected	< 668e050429c7ca688cf4e7112f97f0cd269d446b
`922f56e9a795d6f3dd72d3428ebdd7ee040fa855`	affected	< c0c6f4ba8a37688f7b4d4044898d88f0450d44c2
`18cead61e437f4c7898acca0a5f3df12f801d97f`	affected	—
`6f5780536181d1d0d09a11a1bc92f22e143447e2`	affected	—
`5.15.105`	affected	< 5.15.222
`6.1.22`	affected	< 6.1.189
`5.10.177`	affected	< 5.11
`6.2.9`	affected	< 6.3

Linux

affected

Version	Status	Constraints
`6.3`	affected	—
`0`	unaffected	< 6.3
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[922f56e9a795d6f3dd72d3428ebdd7ee040fa855,69904608e25e8ba58111aadd9210892cf3876201)`	affected	code_commit	—
`[922f56e9a795d6f3dd72d3428ebdd7ee040fa855,72cfcb79026cffb6490f5044153a841d360b0cfc)`	affected	code_commit	—
`[922f56e9a795d6f3dd72d3428ebdd7ee040fa855,668e050429c7ca688cf4e7112f97f0cd269d446b)`	affected	code_commit	—
`[922f56e9a795d6f3dd72d3428ebdd7ee040fa855,c0c6f4ba8a37688f7b4d4044898d88f0450d44c2)`	affected	code_commit	—
`18cead61e437f4c7898acca0a5f3df12f801d97f`	affected	code_commit	—
`4df1f2d36bdc9a368650bf14b9097c555e95f71d`	affected	code_commit	—
`63546395a0e6ac264f78f65218086ce6014b4494`	affected	code_commit	—
`6f5780536181d1d0d09a11a1bc92f22e143447e2`	affected	code_commit	—
`[5.10.177,5.11)`	affected	semver	—
`[5.15.105,5.16)`	affected	semver	—
`[6.1.22,6.2)`	affected	semver	—
`[6.2.9,6.3)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.3`	affected	generic	—
`[0,6.3)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch for the mlx5 e‑switch driver
If an immediate kernel upgrade is not possible, avoid issuing device reset commands while the driver is active to prevent triggering the failure condition
Monitor system logs for references to mlx5 core errors such as reference‑count underflows or page‑fault messages; apply the patch as soon as it becomes available

Generated by OpenCVE AI on October 1, 2026 at 01:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98014.mbox
https://git.kernel.org/stable/c/2196f9d3358b00fcb28835a5fde14071f51ecb96
https://git.kernel.org/stable/c/413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9
https://git.kernel.org/stable/c/5a2b87dfceccf9065157a14a599d395c2b6281b8
https://git.kernel.org/stable/c/668e050429c7ca688cf4e7112f97f0cd269d446b
https://git.kernel.org/stable/c/69904608e25e8ba58111aadd9210892cf3876201
https://git.kernel.org/stable/c/72cfcb79026cffb6490f5044153a841d360b0cfc
https://git.kernel.org/stable/c/c0c6f4ba8a37688f7b4d4044898d88f0450d44c2
https://nvd.nist.gov/vuln/detail/CVE-2026-98014
https://www.cve.org/CVERecord?id=CVE-2026-98014

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2196f9d3358b00fcb28835a5fde14071f51ecb96 https://git.kernel.org/stable/c/413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9 https://git.kernel.org/stable/c/5a2b87dfceccf9065157a14a599d395c2b6281b8

Wed, 30 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98014.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98014 https://www.cve.org/CVERecord?id=CVE-2026-98014
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead of esw_vport_change_handle_locked() so vport->allmulti_rule is NULL before the change handler observes it. During FW-fatal recovery the disable runs while dev->state == INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode() fails and returns early, leaving vport->allmulti_rule intact, so esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries to vport->mc_list whose flow rules are then installed in the FDB by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the FDB with those refs still held, corrupting the sub-tree and leaving dangling flow_rule pointers in vport->mc_list. Two-stage failure on `echo 1 > /sys/bus/pci/devices/<bdf>/reset`: refcount_t: underflow; use-after-free. tree_put_node+0xef/0x110 [mlx5_core] clean_tree+0x44/0xd0 [mlx5_core] (x5) mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core] mlx5_unload+0x65/0xd0 [mlx5_core] ... mlx5_health_try_recover BUG: unable to handle page fault for address: 0000000003000055 down_write+0x1c/0x60 mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core] esw_del_mc_addr+0x7b/0x170 [mlx5_core] esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core] esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core] mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core] ... mlx5_load ... mlx5_health_try_recover esw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule via its local state machine even when the FW del fails. With the rule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change handler closes, no rules are installed during disable, and the reload starts with a clean mc_list.
Title		net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/668e050429c7ca688cf4e7112f97f0cd269d446b https://git.kernel.org/stable/c/69904608e25e8ba58111aadd9210892cf3876201 https://git.kernel.org/stable/c/72cfcb79026cffb6490f5044153a841d360b0cfc https://git.kernel.org/stable/c/c0c6f4ba8a37688f7b4d4044898d88f0450d44c2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:37.131Z

Updated: 2026-10-19T09:12:19.664Z

Reserved: 2026-09-25T10:19:56.069Z

Link: CVE-2026-98014

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:29.767

Modified: 2026-10-19T10:17:54.773

Link: CVE-2026-98014

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98014 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T01:45:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object