All vulnerabilities
CVE-2026-98498

Linux: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in598daa5f95883f881a54967da40ce0fdfc1fdaa8Also 79a3257280a335bbebbcd10d3895e8468bdcd6ae, 288721013605b4e0304e10f6a087b77f71cfad11 and 4 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 598daa5f95883f881a54967da40ce0fdfc1fdaa8LinuxCVE List
  • 79a3257280a335bbebbcd10d3895e8468bdcd6aeLinuxCVE List
  • 288721013605b4e0304e10f6a087b77f71cfad11LinuxCVE List
  • 60eab87d0a798070bf5a856b1d9e5785ce92da53LinuxCVE List
  • 99d8dc51663747078c031acac32edc6d90c8f1f7LinuxCVE List
  • 1f13989a0704bd98cab09f9bee63e2c8a98ad4ddLinuxCVE List
Show all 7 fixed versions
  • 0bf6bb567f0edaa771e7dd208ef98da50e6a4485LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 598daa5f95883f881a54967da40ce0fdfc1fdaa8CVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 79a3257280a335bbebbcd10d3895e8468bdcd6aeCVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before c45c997d0c27359b502587897f775c5a277f0bd4CVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 288721013605b4e0304e10f6a087b77f71cfad11CVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 60eab87d0a798070bf5a856b1d9e5785ce92da53CVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 99d8dc51663747078c031acac32edc6d90c8f1f7CVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 1f13989a0704bd98cab09f9bee63e2c8a98ad4ddCVE List
  • Linuxaffected: 1edae2335adfa7006853e8b427f0c7c3f46b51dd before 0bf6bb567f0edaa771e7dd208ef98da50e6a4485CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8