All vulnerabilities
CVE-2026-98014

Linux: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9Also 2196f9d3358b00fcb28835a5fde14071f51ecb96, 5a2b87dfceccf9065157a14a599d395c2b6281b8 and 7 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9LinuxCVE List
  • 2196f9d3358b00fcb28835a5fde14071f51ecb96LinuxCVE List
  • 5a2b87dfceccf9065157a14a599d395c2b6281b8LinuxCVE List
  • 69904608e25e8ba58111aadd9210892cf3876201LinuxCVE List
  • 72cfcb79026cffb6490f5044153a841d360b0cfcLinuxCVE List
  • 668e050429c7ca688cf4e7112f97f0cd269d446bLinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead of esw_vport_change_handle_locked() so vport->allmulti_rule is NULL before the change handler observes it.

During FW-fatal recovery the disable runs while dev->state == INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode() fails and returns early, leaving vport->allmulti_rule intact, so esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries to vport->mc_list whose flow rules are then installed in the FDB by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the FDB with those refs still held, corrupting the sub-tree and leaving dangling flow_rule pointers in vport->mc_list.

Two-stage failure on echo 1 > /sys/bus/pci/devices/<bdf>/reset:

refcount_t: underflow; use-after-free. tree_put_node+0xef/0x110 [mlx5_core] clean_tree+0x44/0xd0 [mlx5_core] (x5) mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core] mlx5_unload+0x65/0xd0 [mlx5_core] ... mlx5_health_try_recover

BUG: unable to handle page fault for address: 0000000003000055 down_write+0x1c/0x60 mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core] esw_del_mc_addr+0x7b/0x170 [mlx5_core] esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core] esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core] mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core] ... mlx5_load ... mlx5_health_try_recover

esw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule via its local state machine even when the FW del fails. With the rule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change handler closes, no rules are installed during disable, and the reload starts with a clean mc_list.

Text from CVE List

Affected versions 22

  • Linuxaffected: 4df1f2d36bdc9a368650bf14b9097c555e95f71d before 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9CVE List
  • Linuxaffected: 63546395a0e6ac264f78f65218086ce6014b4494 before 2196f9d3358b00fcb28835a5fde14071f51ecb96CVE List
  • Linuxaffected: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 before 5a2b87dfceccf9065157a14a599d395c2b6281b8CVE List
  • Linuxaffected: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 before 69904608e25e8ba58111aadd9210892cf3876201CVE List
  • Linuxaffected: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 before 72cfcb79026cffb6490f5044153a841d360b0cfcCVE List
  • Linuxaffected: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 before 668e050429c7ca688cf4e7112f97f0cd269d446bCVE List
  • Linuxaffected: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 before c0c6f4ba8a37688f7b4d4044898d88f0450d44c2CVE List
  • Linuxaffected: 18cead61e437f4c7898acca0a5f3df12f801d97fCVE List
  • Linuxaffected: 6f5780536181d1d0d09a11a1bc92f22e143447e2CVE List
  • Linuxaffected: 5.15.105 before 5.15.222CVE List
  • Linuxaffected: 6.1.22 before 6.1.189CVE List
  • Linuxaffected: 5.10.177 before 5.11CVE List
  • Linuxaffected: 6.2.9 before 6.3CVE List
  • Linuxaffected: 6.3CVE List
  • Linuxunaffected: all versions before 6.3CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7