Cloudanix VulnDB

CVE-2026-98908

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux driver for certain Microchip network switches can leave internal resources allocated when setup fails, which over time may interfere with network configuration and stability.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incomplete unwinding of allocated PSFP stream gate, flow meter, and stream filter resources on failure paths in sparx5_tc_flower_psfp_setup, plus incorrect psfp_fmid handling on reused flow meters that leaves incremented reference counts behind.

Why it matters to the business

Repeated network configuration attempts on affected hardware can exhaust limited PSFP resources, leading to configuration failures, degraded switch functionality, or eventual system instability.

How an attack unfolds

An attacker with privileges to install TC flower filters repeatedly triggers partial PSFP setup failures after resource allocation, causing persistent leaks that accumulate until resources are exhausted.

How to fix it

Apply the upstream fix that adds explicit release of stream filter, flow meter, and stream gate on all failure paths and corrects the flow-meter ID return value in sparx5_psfp_fm_add before any early return.

How to confirm the fix worked

Inspect the patched sparx5_tc_flower_psfp_setup and sparx5_psfp_fm_add functions for complete error unwinding; exercise TC flower operations that previously hit the failure paths and confirm no orphaned PSFP objects remain.

Typical attack path

  1. Gain local access and privileges sufficient to configure traffic-control flower classifiers
  2. Issue a series of sparx5 PSFP flower setups engineered to fail after stream gate, meter, or filter allocation
  3. Trigger the buggy error paths to leak references without cleanup
  4. Repeat to deplete the finite PSFP resource pools

How to detect it

Search kernel logs and audit records for repeated sparx5 PSFP allocation or flower-setup error messages; correlate with TC configuration attempts that fail after partial resource acquisition.

What your security team should do

  • Prioritize kernel update containing the described error-path fixes on all systems using the microchip sparx5 driver
  • Restrict unprivileged use of TC flower classifiers where operationally feasible
  • Monitor kernel logs for PSFP allocation warnings and track reference-count anomalies during network reconfiguration

The record

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound. Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired. Also make sparx5_psfp_fm_add() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5_psfp_fm_get() increments its pool reference count, but the caller previously kept psfp_fmid as 0. If a later setup step failed, the error path could try to delete flow-meter id 0 instead of the reused flow meter, leaving the incremented reference behind.

Affected packages

Ecosystem Package Introduced Fixed