Cloudanix VulnDB

CVE-2026-98948

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small leak in a Linux network driver can slowly consume hardware resources on certain switches and eventually interfere with network rule handling.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Resource leak in mlxsw_sp_flower_tmplt_create() where port range registers acquired via mlxsw_sp_flower_parse_ports_range() are never released because the local mlxsw_sp_acl_rule_info is never passed to mlxsw_sp_acl_rulei_destroy().

Why it matters to the business

Gradual exhaustion of limited hardware registers on mlxsw Spectrum devices can degrade or disrupt ACL/flow offload operations in production network switches after prolonged use.

How an attack unfolds

An attacker or automated process repeatedly installs flow classification templates that exercise port-range parsing; each template creation leaks registers that are only freed on module unload or reboot, eventually starving legitimate traffic classification.

How to fix it

Update the Linux kernel to a version containing the fix that factors resource release out of mlxsw_sp_acl_rulei_destroy() and invokes it from mlxsw_sp_flower_tmplt_create(). Reboot affected systems after the update.

How to confirm the fix worked

Confirm the running kernel contains the referenced patch; inspect dmesg or mlxsw debug logs after template creation/deletion cycles for absence of register leaks; verify register usage counters remain stable under load.

Typical attack path

  1. Obtain ability to install or influence flower classifier templates on a system using mlxsw spectrum hardware
  2. Trigger repeated mlxsw_sp_flower_tmplt_create() calls that parse port ranges
  3. Observe progressive depletion of port-range registers until ACL operations begin to fail

How to detect it

Review kernel logs for mlxsw register allocation warnings; track hardware resource counters exposed by the mlxsw driver over time; correlate spikes with flower template creation events.

What your security team should do

  • Apply the upstream kernel fix within the next maintenance window given the two-day publication age
  • Prioritize systems running mlxsw Spectrum hardware that perform frequent flower offload operations
  • Monitor register utilization metrics until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak. The issue was found during a review of Wentao Liang's patch referenced below.

Affected packages

Ecosystem Package Introduced Fixed