Live › vulnerability › CVE-2026-99029
Go to dashboardThe Linux kernel's Microchip Sparx5 switch driver does not free the entry it allocates for each offloaded matchall traffic filter when that filter is deleted. Repeatedly adding and deleting such filters leaks kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with the Microchip Sparx5 / lan969x network driver loaded and using tc matchall mirror or goto offload. Machines without that hardware are unlikely to be affected. The sources do not describe the exact trigger rate needed to exhaust memory.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: free the matchall entry on destroy
sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the entry from the list, but never frees it, so the entry of every deleted mirror and goto matchall filter is leaked.
Free the entry after unlinking it.
The leak was discovered by an AI code review agent, and reproduced with kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and deleting matchall mirror and goto filters. With the fix, kmemleak no longer reports the leak.
This page as .md · .json · in your agent: get_signal("CVE-2026-99029")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.