CVE-2026-98014

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead

of esw_vport_change_handle_locked() so vport->allmulti_rule is

NULL before the change handler observes it.

During FW-fatal recovery the disable runs while dev->state ==

INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode()

fails and returns early, leaving vport->allmulti_rule intact, so

esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries

to vport->mc_list whose flow rules are then installed in the FDB

by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the

FDB with those refs still held, corrupting the sub-tree and

leaving dangling flow_rule pointers in vport->mc_list.

Two-stage failure on `echo 1 > /sys/bus/pci/devices/<bdf>/reset`:

refcount_t: underflow; use-after-free.

tree_put_node+0xef/0x110 [mlx5_core]

clean_tree+0x44/0xd0 [mlx5_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References