Live › vulnerability › CVE-2026-98948
Go to dashboardIn the Linux kernel's Mellanox Spectrum switch driver (mlxsw), creating a flower classifier template acquires port range registers that are never released. The leak occurs in the template create and delete path, so repeated use can exhaust those hardware resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mlxsw driver for Mellanox/NVIDIA Spectrum switches that use flower ACL chain templates. Hosts without Spectrum switch hardware or without this driver loaded are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion.
Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak.
The issue was found during a review of Wentao Liang's patch referenced below.
This page as .md · .json · in your agent: get_signal("CVE-2026-98948")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.