CVE-2026-99029

A flaw was found in the Linux kernel's Sparx5 network driver. When removing offloaded matchall traffic control filters, the driver unlinks filter entries without freeing the allocated memory. A local user with network administration privileges can exploit this flaw by repeatedly adding and deleting filters to cause kernel memory exhaustion, resulting in a denial of service (DoS).

This vulnerability is rated as Low severity because triggering the memory leak requires local administrative privileges (CAP_NET_ADMIN) and access to specialized Microchip Sparx5 network switch hardware rarely deployed in standard server environments. Furthermore, the issue only affects kernel availability through memory consumption and does not compromise system confidentiality or data integrity. The vulnerable driver logic is not present in older enterprise releases such as Red Hat Enterprise Linux 8 and 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.