{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-98014", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98014", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-09-25T10:23:37.131Z", "updatedAt": "2026-10-19T09:12:19.664Z", "importedAt": "2026-10-24T01:58:41.756Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "net/mlx5: E-Switch, prevent mc_list repopulation during vport disable", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch, prevent mc_list repopulation during vport disable\n\nIn mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead\nof esw_vport_change_handle_locked() so vport->allmulti_rule is\nNULL before the change handler observes it.\n\nDuring FW-fatal recovery the disable runs while dev->state ==\nINTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode()\nfails and returns early, leaving vport->allmulti_rule intact, so\nesw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries\nto vport->mc_list whose flow rules are then installed in the FDB\nby esw_add_mc_addr(). esw_destroy_legacy_table() tears down the\nFDB with those refs still held, corrupting the sub-tree and\nleaving dangling flow_rule pointers in vport->mc_list.\n\nTwo-stage failure on `echo 1 > /sys/bus/pci/devices//reset`:\n\n refcount_t: underflow; use-after-free.\n tree_put_node+0xef/0x110 [mlx5_core]\n clean_tree+0x44/0xd0 [mlx5_core] (x5)\n mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core]\n mlx5_unload+0x65/0xd0 [mlx5_core]\n ... mlx5_health_try_recover\n\n BUG: unable to handle page fault for address: 0000000003000055\n down_write+0x1c/0x60\n mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core]\n esw_del_mc_addr+0x7b/0x170 [mlx5_core]\n esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core]\n esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core]\n mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core]\n ... mlx5_load ... mlx5_health_try_recover\n\nesw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule\nvia its local state machine even when the FW del fails. With the\nrule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change\nhandler closes, no rules are installed during disable, and the\nreload starts with a clean mc_list.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "4df1f2d36bdc9a368650bf14b9097c555e95f71d", "status": "affected", "versionType": "git", "lessThan": "413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9" }, { "version": "63546395a0e6ac264f78f65218086ce6014b4494", "status": "affected", "versionType": "git", "lessThan": "2196f9d3358b00fcb28835a5fde14071f51ecb96" }, { "version": "922f56e9a795d6f3dd72d3428ebdd7ee040fa855", "status": "affected", "versionType": "git", "lessThan": "5a2b87dfceccf9065157a14a599d395c2b6281b8" }, { "version": "922f56e9a795d6f3dd72d3428ebdd7ee040fa855", "status": "affected", "versionType": "git", "lessThan": "69904608e25e8ba58111aadd9210892cf3876201" }, { "version": "922f56e9a795d6f3dd72d3428ebdd7ee040fa855", "status": "affected", "versionType": "git", "lessThan": "72cfcb79026cffb6490f5044153a841d360b0cfc" }, { "version": "922f56e9a795d6f3dd72d3428ebdd7ee040fa855", "status": "affected", "versionType": "git", "lessThan": "668e050429c7ca688cf4e7112f97f0cd269d446b" }, { "version": "922f56e9a795d6f3dd72d3428ebdd7ee040fa855", "status": "affected", "versionType": "git", "lessThan": "c0c6f4ba8a37688f7b4d4044898d88f0450d44c2" }, { "version": "18cead61e437f4c7898acca0a5f3df12f801d97f", "status": "affected", "versionType": "git" }, { "version": "6f5780536181d1d0d09a11a1bc92f22e143447e2", "status": "affected", "versionType": "git" }, { "version": "5.15.105", "status": "affected", "versionType": "semver", "lessThan": "5.15.222" }, { "version": "6.1.22", "status": "affected", "versionType": "semver", "lessThan": "6.1.189" }, { "version": "5.10.177", "status": "affected", "versionType": "semver", "lessThan": "5.11" }, { "version": "6.2.9", "status": "affected", "versionType": "semver", "lessThan": "6.3" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.3" }, { "version": "5.15.222", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.189", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.158", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.111", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.53", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.7", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }