CVE-2026-98895

What it actually does

Use-after-free in the mlx5 HWS table management code where destroying a table that references a miss table via mlx5hws_table_set_default_miss leaves a dangling node in the miss_tbl list, allowing subsequent access to freed memory.

Why it matters to the business

Systems using mlx5 network hardware may experience kernel crashes, memory corruption, or local privilege escalation if an attacker triggers the flaw, potentially disrupting network services or allowing unauthorized access on affected Linux hosts.

How an attack unfolds

A local attacker invokes mlx5 hardware steering table creation and miss table attachment APIs, then destroys the primary table without proper list cleanup, leaving a dangling reference that is later dereferenced during miss table operations to corrupt kernel memory.

How to fix it

Apply the upstream kernel patch that removes the table from the miss_tbl list on destruction; upgrade to a kernel version containing the fix for net/mlx5 HWS table handling.

How to confirm the fix worked

Confirm the mlx5 driver source contains the list removal logic before miss_tbl cleanup; test table create/destroy sequences under HWS to ensure no dangling references remain; monitor for kernel oops or slab corruption on affected hardware.

Typical attack path

1. Obtain local user access on a Linux system with mlx5 hardware and HWS enabled
2. Load or interact with mlx5 driver interfaces to allocate steering tables
3. Call mlx5hws_table_set_default_miss to attach a miss table
4. Destroy the primary table to leave the stale list entry
5. Trigger subsequent miss table operations to access freed memory

How to detect it

Inspect kernel logs for mlx5 HWS table destruction errors or use-after-free warnings; review audit logs for unusual calls to mlx5 steering APIs from untrusted processes; examine crash dumps for mlx5 miss_tbl list corruption.

What your security team should do

• Prioritize kernel updates on all systems exposing mlx5 hardware within the next patch cycle given the local impact
• Restrict unprivileged local access and HWS configuration where possible until patched
• Review mlx5 driver usage in container or virtualization workloads for additional exposure