---
id: "CVE-2026-98908"
kind: "vulnerability"
aliases: ["CVE-2026-98908"]
title: "Linux kernel: Sparx5 PSFP setup failure leaks resources and wrong flow meter"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "network-hardware", "sparx5"]
not_affected_if: ["no-sparx5-hardware"]
published_at: "2026-10-23T12:18:24+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98908", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98908", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: Sparx5 PSFP setup failure leaks resources and wrong flow meter

In the Linux kernel's Microchip Sparx5 network driver, a failed PSFP flower setup does not release the stream gate, flow meter and stream filter resources it had already allocated, and a reused flow meter can be the wrong one to release. The sources describe a resource leak and wrong-id cleanup, and do not describe an attacker gaining access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98908 (the sources do not name a version).

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98908
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98908

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: microchip: sparx5: clean up PSFP resources on flower setup failure

sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and
stream filter resources before adding VCAP actions. If a later step
fails, the resources allocated earlier in the function are not unwound.

Add error paths to release the stream filter, flow meter and stream gate
when setup fails after they have been acquired.

Also make sparx5_psfp_fm_add() return the acquired flow-meter id before
the existing-flow-meter early return. When an existing flow meter is
reused, sparx5_psfp_fm_get() increments its pool reference count, but the
caller previously kept psfp_fmid as 0. If a later setup step failed, the
error path could try to delete flow-meter id 0 instead of the reused flow
meter, leaving the incremented reference behind.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_