CVE-2026-98908 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net: microchip: sparx5: clean up PSFP resources on flower setup failure
sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound.
Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired.
Also make sparx5_psfp_fm_add() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5_psfp_fm_get() increments its pool reference count, but the caller previously kept psfp_fmid as 0. If a later setup step failed, the error path could try to delete flow-meter id 0 instead of the reused flow meter, leaving the incremented reference behind.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel network subsystem for Microchip Sparx5 switches represents a resource management flaw within the Packet Stream Filtering PSFP implementation. Specifically, the function sparx5_tc_flower_psfp_setup is responsible for configuring traffic filtering rules by allocating hardware resources such as stream gates, flow meters, and stream filters before attaching Virtual Content Addressable Memory VCAP actions to these structures. The core technical defect lies in the error handling logic of this initialization sequence. When a subsequent step fails after initial resource allocation has occurred, the function does not properly unwind or release the previously acquired hardware resources. This oversight results in leaked kernel objects that remain allocated but orphaned from their intended configuration context, leading to progressive resource exhaustion over time as more failed setup attempts occur.
From an operational perspective, this flaw can lead to significant stability and performance degradation on network devices utilizing Sparx5 silicon. As the number of incomplete or failed PSFP configurations increases due to misconfigurations or transient errors, the system accumulates unreleased stream gates, flow meters, and filters. Since these hardware resources are finite within the switch ASIC, their gradual depletion can eventually prevent new legitimate traffic filtering rules from being established. This effectively degrades the network's ability to enforce quality of service policies, rate limiting, and packet classification, potentially causing unintended traffic behavior or complete loss of PSFP functionality for affected ports.
The vulnerability is further complicated by a secondary logic error regarding flow meter reference counting. The function sparx5_psfp_fm_add was previously returning zero when an existing flow meter was reused rather than the actual identifier of that resource. Consequently, if the setup process failed later in its execution path, the cleanup routine would attempt to delete a non-existent or invalid flow meter ID of zero instead of correctly referencing and releasing the shared flow meter instance. This mismatch leaves reference counts incremented but unreleased, exacerbating the resource leak issue by preventing the system from reclaiming memory associated with these hardware structures even when they are no longer actively used in that specific configuration context.
This type of defect is classified under CWE-401 which denotes a missing release of memory after successful allocation, and more specifically aligns with CWE-755 related to improper handling of exceptional conditions leading to resource leaks. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability does not directly facilitate an attack but creates a condition that can be leveraged for Denial of Service DoS attacks through resource exhaustion. An attacker or malicious script could theoretically trigger repeated configuration failures to accelerate the depletion of hardware resources, thereby disrupting network operations without needing direct code execution privileges on the device itself if they have access to traffic classification rules.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects these error paths. The fix ensures that all allocated PSFP resources are properly released in every failure scenario within sparx5_tc_flower_psfp_setup. Additionally, it rectifies the return value logic for existing flow meters so that reference counts are accurately managed and decremented when no longer needed. System administrators should ensure their Sparx5-based network equipment is updated to a kernel version containing this fix. Regular auditing of hardware resource usage statistics on these switches can also help detect early signs of leakage, allowing for proactive maintenance before operational impact becomes severe.