Live › vulnerability › CVE-2026-98498
Go to dashboardIn the Linux kernel's mlx5 network driver, a shared connection-tracking counter lookup fails to drop a reference when the counter is already being released, so the reverse entry is never freed. The sources describe a resource leak, and they do not say whether an attacker can exploit it to run code or read data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mlx5 driver (Mellanox/NVIDIA ConnectX NICs) and the TC connection-tracking offload enabled. Hosts without mlx5 hardware or without that offload are not affected by this code path. The sources do not say which kernel versions are fixed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.
This page as .md · .json · in your agent: get_signal("CVE-2026-98498")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.