CVE-2026-98016

A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A race condition occurs during the concurrent teardown of traffic control (TC) sample rules sharing the same context, causing the system to reference memory after it has already been freed. A local user with network administrative capabilities could exploit this flaw to cause a Denial of Service (DoS) or potentially execute arbitrary code.

A race in sample_restore_put can access a shared mlx5e sample restore object after another teardown thread has removed and freed it. One thread can decrement restore.count and release restore_lock while another thread reaches zero, destroys the associated rule and modify header, and frees the restore object before the first thread reads the count again. This creates an explicit use after free read and may also cause repeated cleanup or a double free if the stale count is observed as zero. For the CVSS the PR:L reflects that a local process normally needs CAP_NET_ADMIN or delegated TC control to create and concurrently remove the affected sampling rules, but it does not require full control of the host. The issue is not directly network reachable through ordinary packet traffic because the vulnerable path is TC rule teardown in the network control plane. Impact is at least a local denial of service through kernel memory corruption and a crash. In the worst defensible case the possible double free may affect confidentiality and integrity or support privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.