CVE-2026-98015 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
In mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads tt->ref_count after termtbl_mutex has been released. Two concurrent callers on the same mlx5_termtbl_handle race: one decrements ref_count to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->ref_count), producing a use-after-free.
Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtbl_mutex, and tt is not touched after kfree.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel network driver for Mellanox ConnectX adapters represents a classic use-after-free condition arising from improper synchronization during reference count management. Specifically located within the mlx5_eswitch_termtbl_put function, this flaw occurs when handling termination table references associated with Ethernet switch offloading features. The core issue stems from a race condition where the kernel attempts to determine if an object should be deallocated based on its reference count after releasing the mutex that protects access to that data structure. This sequence of operations creates a window of vulnerability during which concurrent threads can interfere with each other, leading to memory corruption and potential system instability or compromise.
The technical mechanism behind this flaw involves the interaction between two concurrent callers operating on the same mlx5_termtbl_handle instance. In the original implementation, one thread decrements the reference count and, upon reaching zero, proceeds to remove the hash entry and free the associated memory structure using kfree. Simultaneously or shortly thereafter, a second caller that has already released the termtbl_mutex attempts to evaluate whether the reference count is zero to decide on cleanup actions. Because the mutex was dropped before this evaluation in the flawed logic path, the second thread may access the tt pointer after it has been freed by the first thread. This results in reading from or writing to a memory region that no longer belongs to the process, which constitutes an invalid memory access vulnerability.
From a classification perspective, this issue aligns with CWE-416, Use After Free, where software continues to use a pointer after it has been freed. The root cause is categorized under CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as the race condition exists due to insufficient locking around critical sections that modify shared state. In terms of attack vectors and behavioral patterns, this vulnerability maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, if exploited for arbitrary code execution via kernel memory corruption, or more broadly to privilege escalation scenarios where an attacker leverages the use-after-free to overwrite adjacent kernel structures such as function pointers. This could allow a local user with access to the affected network device interface to escalate privileges to root level by manipulating kernel control flow during the exploitation of this race condition.
The operational impact of this vulnerability is significant, particularly in environments where Mellanox ConnectX adapters are used for high-performance networking and virtualization offloading features like SR-IOV or OVS-DPDK integration. An attacker who can trigger rapid reference count changes on termination tables could crash the system through a kernel panic caused by accessing freed memory. More critically, skilled attackers may exploit this race condition to achieve arbitrary read/write primitives in kernel space. This enables bypassing security mechanisms such as SELinux or AppArmor, extracting sensitive data from kernel memory including cryptographic keys and credentials, or installing rootkits that persist across reboots due to the deep integration of network drivers into the operating system core.
The resolution implemented by the Linux community addresses this flaw through a precise adjustment in synchronization logic within the mlx5_eswitch_termtbl_put function. The fix involves capturing the result of the reference count decrement operation into a local stack variable before releasing the termtbl_mutex. This ensures that the decision to perform cleanup, including checking if the reference count has reached zero and subsequently freeing memory via kfree, is made entirely while holding the mutex lock. By keeping the critical section intact during both the evaluation and the deallocation phases, the race window is eliminated. Furthermore, the updated code structure guarantees that the tt pointer is not accessed after it has been freed, thereby preventing any subsequent use-after-free scenarios even if other threads attempt to access the data concurrently.
To mitigate this vulnerability in deployed systems, administrators should ensure that all Linux kernels are updated to versions containing the patch for mlx5_eswitch_termtbl_put. Since this issue resides within a specific network driver component, it primarily affects systems utilizing Mellanox ConnectX series adapters with enabled switch offloading features. For environments where immediate kernel updates are not feasible due to stability concerns or maintenance windows, disabling advanced Ethernet switch offloading capabilities in the mlx5 driver configuration can reduce the attack surface by preventing the creation of termination table handles that trigger this code path. Additionally, deploying intrusion detection systems capable of monitoring for unusual patterns of network device interface usage and reference count manipulation may help identify attempted exploitation activities before they result in successful compromise.