CVE-2026-98014

A flaw was found in the Linux kernel's Mellanox network driver (mlx5). This vulnerability allows a local privileged user to cause a Denial of Service (DoS) through a system crash. During hardware reset or error recovery procedures, improper cleanup when disabling a virtual network port leaves stale memory references, triggering memory corruption through a use-after-free flaw.

An ordering flaw in mlx5 E-Switch vport shutdown can repopulate mc_list with FDB flow rules while the device is in INTERNAL_ERROR state. The subsequent FDB teardown leaves dangling flow_rule pointers and corrupts steering tree reference counts. A later recovery or reload can traverse these stale entries and trigger a refcount underflow, use-after-free, page fault, and kernel crash. For the CVSS the PR:L value is used in the paranoid assessment because some SR-IOV environments delegate VF or vport management to a reduced capability tenant or service account that may influence the recovery sequence. The directly documented PCI reset trigger normally requires administrative privileges and therefore the base assessment uses PR:H. The issue is not proven to be directly network reachable because ordinary traffic alone does not initiate the required firmware fatal recovery and device reload sequence. Impact is at least local denial of service. The concrete dangling pointer and use-after-free condition may also permit confidentiality or integrity impact and possible privilege escalation if the freed object can be reused in a controlled manner.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.