CVE-2026-98908 - Vulnerability Details

- net: microchip: sparx5: clean up PSFP resources on flower setup failure

Description

In the Linux kernel, the following vulnerability has been resolved:

net: microchip: sparx5: clean up PSFP resources on flower setup failure

sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and
stream filter resources before adding VCAP actions. If a later step
fails, the resources allocated earlier in the function are not unwound.

Add error paths to release the stream filter, flow meter and stream gate
when setup fails after they have been acquired.

Also make sparx5_psfp_fm_add() return the acquired flow-meter id before
the existing-flow-meter early return. When an existing flow meter is
reused, sparx5_psfp_fm_get() increments its pool reference count, but the
caller previously kept psfp_fmid as 0. If a later setup step failed, the
error path could try to delete flow-meter id 0 instead of the reused flow
meter, leaving the incremented reference behind.

Published: 2026-10-23

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel driver for Microchip sparx5 fails to release PSFP stream gate, flow meter, and stream filter resources when a flower configuration step fails, causing a persistent resource leak that can accumulate over time and potentially exhaust kernel memory or other scarce resources. This is a Resource Leak weakness (CWE-772) and may lead to system instability or crash.

Affected Systems

All Linux kernel installations that include the Microchip sparx5 network driver are affected until the driver incorporates the described cleanup fix.

Risk and Exploitability

The failure path is triggered during PSFP flower configuration; an attacker would need to induce repeated configuration failures, which is inferred to require either privileged system access or the ability to craft network traffic that engages this driver function. The EPSS score is <1%, CVSS 2.3, and the vulnerability is not listed in CISA KEV. The potential impact is a denial‑of‑service condition through resource exhaustion if the error path is triggered repeatedly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6ebf182bfdf15bd58ebcf6760b06458694e0fad2`	affected	< a7625d408f7f0535c2b0f05d53231d6496acd48b
`6ebf182bfdf15bd58ebcf6760b06458694e0fad2`	affected	< a46ea3f7ee0d3ad3d5e92043232b293be2a305d3
`6ebf182bfdf15bd58ebcf6760b06458694e0fad2`	affected	< 640c1bd8d359ad34817f5afec0872985e87b49ec
`6ebf182bfdf15bd58ebcf6760b06458694e0fad2`	affected	< 46e50367338702abe3df661df7795bdada40fef7

Linux

affected

Version	Status	Constraints
`6.3`	affected	—
`0`	unaffected	< 6.3
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a7625d408f7f0535c2b0f05d53231d6496acd48b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a46ea3f7ee0d3ad3d5e92043232b293be2a305d3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,640c1bd8d359ad34817f5afec0872985e87b49ec)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,46e50367338702abe3df661df7795bdada40fef7)`	affected	code_commit	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a7625d408f7f0535c2b0f05d53231d6496acd48b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a46ea3f7ee0d3ad3d5e92043232b293be2a305d3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,640c1bd8d359ad34817f5afec0872985e87b49ec)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,46e50367338702abe3df661df7795bdada40fef7)`	affected	code_commit	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a kernel release that contains the sparx5_psfp resource cleanup patch
If no patch is available, disable PSFP or flower features in the driver to prevent the failure path from being exercised
Continuously monitor kernel logs and system resource usage for signs of leaks, using this information to identify if the bug remains active

Generated by OpenCVE AI on October 27, 2026 at 22:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00174.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98908.mbox
https://git.kernel.org/stable/c/46e50367338702abe3df661df7795bdada40fef7
https://git.kernel.org/stable/c/640c1bd8d359ad34817f5afec0872985e87b49ec
https://git.kernel.org/stable/c/a46ea3f7ee0d3ad3d5e92043232b293be2a305d3
https://git.kernel.org/stable/c/a7625d408f7f0535c2b0f05d53231d6496acd48b
https://nvd.nist.gov/vuln/detail/CVE-2026-98908
https://www.cve.org/CVERecord?id=CVE-2026-98908

History

Tue, 27 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-211 CWE-667

Tue, 27 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98908.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98908 https://www.cve.org/CVERecord?id=CVE-2026-98908
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Fri, 23 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-211 CWE-667

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound. Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired. Also make sparx5_psfp_fm_add() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5_psfp_fm_get() increments its pool reference count, but the caller previously kept psfp_fmid as 0. If a later setup step failed, the error path could try to delete flow-meter id 0 instead of the reused flow meter, leaving the incremented reference behind.
Title		net: microchip: sparx5: clean up PSFP resources on flower setup failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/46e50367338702abe3df661df7795bdada40fef7 https://git.kernel.org/stable/c/640c1bd8d359ad34817f5afec0872985e87b49ec https://git.kernel.org/stable/c/a46ea3f7ee0d3ad3d5e92043232b293be2a305d3 https://git.kernel.org/stable/c/a7625d408f7f0535c2b0f05d53231d6496acd48b

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:54:46.243Z

Updated: 2026-10-26T06:56:37.786Z

Reserved: 2026-09-25T10:25:14.379Z

Link: CVE-2026-98908

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:24.907

Modified: 2026-10-26T07:17:16.150

Link: CVE-2026-98908

Redhat

Severity : Low

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98908 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T22:30:10Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object