All vulnerabilities
CVE-2026-98015

Linux: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in92f581cac93a71723456ac79ef54d9f60a251b42Also 304ea40ef4561671503c36e47da44a0a31b71e36, 18b2969073879b9cce24e1a78b118bdad54518d1 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 92f581cac93a71723456ac79ef54d9f60a251b42LinuxCVE List
  • 304ea40ef4561671503c36e47da44a0a31b71e36LinuxCVE List
  • 18b2969073879b9cce24e1a78b118bdad54518d1LinuxCVE List
  • 7ee07f601f8f507c9faf25c68a49396ab8950596LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free.

Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.

Text from CVE List

Affected versions 18

  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before e3ee194a790896fa92fea20b5385a354be2f2c12CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before 92f581cac93a71723456ac79ef54d9f60a251b42CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before a5833fdf53350b8b95a558fcf0056ddb1c0fe154CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before 304ea40ef4561671503c36e47da44a0a31b71e36CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before e393789e92310d7c66f57c876101779c90816a12CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before 18b2969073879b9cce24e1a78b118bdad54518d1CVE List
  • Linuxaffected: 10caabdaad5ace85577a453da97d1f8d3b944427 before 7ee07f601f8f507c9faf25c68a49396ab8950596CVE List
  • Linuxaffected: 5.3CVE List
  • Linuxunaffected: all versions before 5.3CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8