CVE-2026-98015

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads

tt->ref_count after termtbl_mutex has been released. Two concurrent

callers on the same mlx5_termtbl_handle race: one decrements ref_count

to zero, removes the hash entry, and calls kfree(tt) while the other

has already dropped the mutex and is about to evaluate

if (!tt->ref_count), producing a use-after-free.

Fix this by capturing the result of the decrement into a stack-local

last variable before dropping the mutex. The cleanup decision is now

made entirely under termtbl_mutex, and tt is not touched after

kfree.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References