{"id":"CVE-2026-98948","kind":"vulnerability","aliases":["CVE-2026-98948"],"related":[],"title":"Linux kernel: mlxsw template creation leaks port range registers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\n\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\n\nThe issue was found during a review of Wentao Liang's patch referenced\nbelow.","summary":"In the Linux kernel's Mellanox Spectrum switch driver (mlxsw), creating a flower classifier template acquires port range registers that are never released. The leak occurs in the template create and delete path, so repeated use can exhaust those hardware resources.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","mlxsw","network-switch","runtime"],"not_affected_if":["driver-not-loaded","no-spectrum-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:55+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:57:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: mlxsw template creation leaks port range registers","impact":"low","summary":"In the Linux kernel's Mellanox Spectrum switch driver (mlxsw), creating a flower classifier template acquires port range registers that are never released. The leak occurs in the template create and delete path, so repeated use can exhaust those hardware resources.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","mlxsw","network-switch"],"confidence":0.5,"needs_auth":"unknown","worst_case":"resource leak exhausts switch port range registers over time","analyst_note":"Check the upstream kernel stable commit and NVD entry for affected kernel versions and the fixed commit; sources give no version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-spectrum-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the mlxsw driver for Mellanox/NVIDIA Spectrum switches that use flower ACL chain templates. Hosts without Spectrum switch hardware or without this driver loaded are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000576,"input_tokens":3520,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98948':12A,15A 'acl':105C,134C,152C 'acquir':39B,114C 'actual':158C 'call':164C 'chain':144C 'classifi':37B 'cls':94C 'code':156C 'comput':110C 'creat':34B,53B,85C,90C,170C 'creation':5A 'cve':10A,13A 'delet':55B,146C 'destroy':136C,154C 'driver':32B 'exhaust':61B 'factor':147C 'fix':78C 'flow':93C 'flower':36B,77C,88C,121C,168C 'follow':70C 'found':178C 'goe':130C 'hardwar':63B 'includ':142C 'info':107C 'issu':176C 'kernel':2A,18B,27B,68C 'leak':6A,48B,82C,174C 'liang':184C 'linux':1A,17B,26B,67C 'linux-kernel':16B 'local':101C 'mellanox':29B 'mlxsw':3A,19B,33B,75C,86C,103C,119C,132C,150C,166C 'necessari':161C 'network':21B 'network-switch':20B 'never':45B,129C,140C 'occur':49B 'offload':95C 'pars':91C,112C,122C 'patch':186C 'path':56B 'plug':172C 'port':7A,40B,79C,115C,123C 'pure':108C 'rang':8A,41B,80C,116C,124C 'referenc':187C 'regist':9A,42B,81C,117C,138C 'releas':46B,141C,159C 'repeat':58B 'resolv':74C 'resourc':64B,162C 'review':181C 'rule':106C 'rulei':128C,135C,153C 'rulei.values.elusage':111C 'runtim':23B 'sinc':126C 'sp':87C,104C,120C,133C,151C,167C 'spectrum':30B,76C 'stack':100C 'stack-loc':99C 'struct':102C 'switch':22B,31B 'templat':4A,38B,52B,96C,145C 'tmplt':84C,89C,169C 'use':59B 'via':118C 'vulner':71C 'wentao':183C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mlxsw driver for Mellanox/NVIDIA Spectrum switches that use flower ACL chain templates. Hosts without Spectrum switch hardware or without this driver loaded are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98948","severity":null,"published_at":"2026-10-23T13:17:15+00:00","modified_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98948","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98948","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}