Cloudanix VulnDB

CVE-2026-98498

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A small bug in Linux network driver code can slowly use up memory on certain high-speed network cards, eventually affecting performance.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A reference count leak occurs in mlx5_tc_ct_shared_counter_get when refcount_inc_not_zero fails on a reverse entry whose counter is releasing; the prior reference acquired by mlx5_tc_ct_entry_get is never dropped, leaving the reverse entry permanently referenced.

Why it matters to the business

Systems using mlx5 network hardware for connection tracking may experience gradual kernel memory exhaustion, degrading network throughput and stability under sustained load.

How an attack unfolds

An attacker triggers concurrent shared-counter lookups and counter-release paths in the mlx5 TC CT code to hit the failed refcount_inc_not_zero branch, causing the reference leak; repeated triggering can accumulate unreleased objects.

How to fix it

Apply the upstream kernel patch that adds the missing reference drop in mlx5_tc_ct_shared_counter_get before falling through to create_counter; rebuild and deploy the fixed kernel on affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the mlx5_tc_ct.c source for the added refcount drop after the failed inc_not_zero, or verify the running kernel contains the commit resolving the leak.

Typical attack path

  1. Perform operations that invoke mlx5_tc_ct_shared_counter_get on a shared counter
  2. Induce a race where the reverse entry's counter begins release
  3. Force refcount_inc_not_zero to fail while the entry reference remains held
  4. Repeat to accumulate leaked reverse entries

How to detect it

Examine kernel memory statistics and slab usage for mlx5_tc_ct related objects showing unexpected growth; review logs for repeated mlx5 TC CT counter operations under load.

What your security team should do

  • Prioritize patching mlx5-based systems within normal kernel update cycles given low EPSS
  • Monitor memory usage of mlx5_tc_ct structures on high-traffic hosts
  • Review connection-tracking configurations that may increase exposure to the shared-counter path

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.

Affected packages

Ecosystem Package Introduced Fixed