CVE-2026-98895 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: HWS, Handle destroying table that has a miss table
If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is deleted, we need to also remove it from the miss_tbl list, otherwise the node in miss_tbl list will contain garbage.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel networking subsystem contains a specific logic flaw within the Mellanox ConnectX hardware steering (HWS) implementation that results in use-after-free conditions and potential system instability. This vulnerability arises from improper lifecycle management of table references when dealing with miss tables, which are critical components for handling packets that do not match any existing rule in a flow table. The core issue is located in the code path responsible for destroying or deleting a hardware steering table that has an associated default miss action configured via the mlx5hws_table_set_default_miss API function. When such a configuration exists, the system maintains a bidirectional relationship where the miss table keeps track of all parent tables pointing to it through a linked list structure.
During normal operation, this linkage allows for efficient management of flow rules and their fallback behaviors. However, when an administrator or kernel component initiates the deletion of a specific hardware steering table that is registered in the miss table's tracking list, the current implementation fails to remove the corresponding node from that list before freeing the memory associated with the original table object. This omission leaves a dangling pointer within the miss_tbl linked list, pointing to deallocated memory space. Consequently, any subsequent operation by the kernel or hardware driver that iterates over this list will attempt to access invalid memory addresses, leading to undefined behavior.
The operational impact of this vulnerability is severe and can manifest in multiple ways depending on timing and system state. The most immediate consequence is a kernel panic or crash due to an illegal memory access when the garbage pointer is dereferenced during table iteration or cleanup routines. In less catastrophic scenarios, particularly if the freed memory has been reallocated for other purposes, accessing this stale reference can lead to data corruption within unrelated subsystems or subtle logic errors in packet processing paths. This undermines the reliability of network connectivity and could potentially be exploited by local attackers with sufficient privileges to trigger table destruction operations, leading to denial-of-service conditions against the host system.
From a vulnerability classification perspective, this flaw aligns closely with CWE-416, Use After Free, as it involves accessing memory after it has been freed due to incorrect pointer management. It also relates to CWE-825, Expired Pointer Dereference, because the list node retains a reference to an object that is no longer valid in memory. In terms of attack vectors and techniques, this type of error can be leveraged within the MITRE ATT&CK framework under T1059, Command and Scripting Interpreter, or more broadly as part of privilege escalation chains where kernel instability is induced to gain control over system execution flow. The vulnerability resides in the net/mlx5 driver, which interfaces directly with Mellanox network interface cards, making it a critical component for high-performance networking environments.
Mitigation strategies must focus on correcting the lifecycle management logic within the mlx5hws module. Developers should ensure that when a table is destroyed, any references to that table in associated data structures, such as the miss_tbl list, are explicitly removed prior to freeing the memory resources of the table itself. This requires careful ordering of operations during cleanup routines to maintain pointer integrity. For system administrators unable to immediately apply kernel patches, restricting access to network configuration tools and monitoring for unusual kernel log messages related to mlx5 drivers can help mitigate risk exposure until a fix is deployed. Regular updates to the Linux kernel are essential to resolve these low-level driver bugs that compromise system stability and security posture in enterprise networking infrastructure.