{"id":"CVE-2026-98908","kind":"vulnerability","aliases":["CVE-2026-98908"],"related":[],"title":"Linux kernel: Sparx5 PSFP setup failure leaks resources and wrong flow meter","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: microchip: sparx5: clean up PSFP resources on flower setup failure\n\nsparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and\nstream filter resources before adding VCAP actions. If a later step\nfails, the resources allocated earlier in the function are not unwound.\n\nAdd error paths to release the stream filter, flow meter and stream gate\nwhen setup fails after they have been acquired.\n\nAlso make sparx5_psfp_fm_add() return the acquired flow-meter id before\nthe existing-flow-meter early return. When an existing flow meter is\nreused, sparx5_psfp_fm_get() increments its pool reference count, but the\ncaller previously kept psfp_fmid as 0. If a later setup step failed, the\nerror path could try to delete flow-meter id 0 instead of the reused flow\nmeter, leaving the incremented reference behind.","summary":"In the Linux kernel's Microchip Sparx5 network driver, a failed PSFP flower setup does not release the stream gate, flow meter and stream filter resources it had already allocated, and a reused flow meter can be the wrong one to release. The sources describe a resource leak and wrong-id cleanup, and do not describe an attacker gaining access.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","network-hardware","sparx5"],"not_affected_if":["no-sparx5-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98908 (the sources do not name a version).","status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:32+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:58:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98908 (the sources do not name a version).","reach":"local","title":"Linux kernel: Sparx5 PSFP setup failure leaks resources and wrong flow meter","impact":"low","summary":"In the Linux kernel's Microchip Sparx5 network driver, a failed PSFP flower setup does not release the stream gate, flow meter and stream filter resources it had already allocated, and a reused flow meter can be the wrong one to release. The sources describe a resource leak and wrong-id cleanup, and do not describe an attacker gaining access.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","sparx5","network-hardware"],"confidence":0.4,"needs_auth":"unknown","worst_case":"resource leak and wrong flow-meter cleanup in kernel driver","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-sparx5-hardware"],"who_is_affected":"Systems running a Linux kernel with the Microchip Sparx5 network driver (sparx5 switch hardware) that use PSFP stream filtering through tc flower offload. Hosts without Sparx5 hardware are not affected by this driver flaw. The sources do not say how a team confirms the driver is loaded.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3531,"output_tokens":514,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98908':15A,18A '0':209C,227C 'access':87B 'acquir':163C,172C 'action':127C 'add':125C,143C,169C 'alloc':56B,114C,135C 'alreadi':55B 'also':164C 'attack':85B 'behind':238C 'caller':203C 'clean':101C 'cleanup':79B 'could':219C 'count':200C 'cve':13A,16A 'delet':222C 'describ':71B,83B 'driver':35B 'earli':183C 'earlier':136C 'error':144C,217C 'exist':180C,187C 'existing-flow-met':179C 'fail':37B,132C,158C,215C 'failur':6A,108C 'filter':51B,122C,150C 'flow':11A,47B,60B,118C,151C,174C,181C,188C,224C,232C 'flow-met':173C,223C 'flower':39B,106C,111C 'fm':168C,194C 'fmid':207C 'follow':93C 'function':139C 'gain':86B 'gate':46B,117C,155C 'get':195C 'hardwar':25B 'id':78B,176C,226C 'increment':196C,236C 'infrastructur':19B 'instead':228C 'kept':205C 'kernel':2A,22B,30B,91C 'later':130C,212C 'leak':7A,74B 'leav':234C 'linux':1A,21B,29B,90C 'linux-kernel':20B 'make':165C 'meter':12A,48B,61B,119C,152C,175C,182C,189C,225C,233C 'microchip':32B,99C 'net':98C 'network':24B,34B 'network-hardwar':23B 'one':66B 'path':145C,218C 'pool':198C 'previous':204C 'psfp':4A,38B,103C,112C,115C,167C,193C,206C 'refer':199C,237C 'releas':43B,68B,147C 'resolv':97C 'resourc':8A,52B,73B,104C,123C,134C 'return':170C,184C 'reus':59B,191C,231C 'setup':5A,40B,107C,113C,157C,213C 'sourc':70B 'sparx5':3A,26B,33B,100C,109C,166C,192C 'step':131C,214C 'stream':45B,50B,116C,121C,149C,154C 'tc':110C 'tri':220C 'unwound':142C 'vcap':126C 'vulner':94C 'wrong':10A,65B,77B 'wrong-id':76B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Microchip Sparx5 network driver (sparx5 switch hardware) that use PSFP stream filtering through tc flower offload. Hosts without Sparx5 hardware are not affected by this driver flaw. The sources do not say how a team confirms the driver is loaded.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98908","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98908","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98908","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}