CVE-2026-98015

A flaw was found in the Linux kernel's mlx5 driver. A local attacker can cause a Denial of Service (DoS) via a use-after-free vulnerability in the network switch offload mechanism. This issue arises when concurrent operations race while releasing termination table handles in the mlx5_eswitch_termtbl_put() function, allowing memory to be accessed after it has already been freed.

A race in mlx5_eswitch_termtbl_put can access a termination table handle after another caller has reduced its reference count to zero and freed it. Two concurrent callers can also both observe the zero reference count and attempt to delete the same flow rule, destroy the same flow table, and free the same object. This creates a use-after-free and a plausible double cleanup or double-free condition that may crash the kernel and could potentially support privilege escalation through kernel memory corruption. For the CVSS the PR:L value is used for the paranoid score because mlx5 E-Switch control may be delegated to a container root or a service account with network administration capabilities, even though normal host configuration usually requires higher administrative privileges. AC:H applies because reliable triggering depends on winning a concurrency window between two cleanup operations. The issue is not directly network reachable through ordinary packet traffic and normally requires local access to the mlx5 E-Switch control plane. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality and integrity compromise due to the plausible double-free condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.