AZL-110753: CVE-2026-98948 affecting package kernel 6.6.157.1-1

Q: Which systems are exposed to this resource leak?

Systems using the mlxsw Spectrum flower offload path are exposed when flow classifier offload templates with port ranges are parsed. The leak concerns port range registers acquired during template creation.

Q: What activity triggers the leak?

Creating a flow_cls_offload template that causes mlxsw_sp_flower_parse_ports_range() to acquire port range registers can trigger it. The stack-local rule information used during template parsing was not destroyed, so the acquired registers were not released.

Q: Does deleting the chain template release the leaked registers?

No. The description states that the registers were never released, including through chain template deletion.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrumflower: Fix port range register leak in tmpltcreate()

mlxswspflowertmpltcreate() parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxswspflowerparseportsrange(), but since this rulei never goes through mlxswspaclruleidestroy(), those registers were never released, including through chain template deletion.

Factor out of mlxswspaclruleidestroy() the code to actually release the necessary resources and call from mlxswspflowertmpltcreate() to plug the leak.

The issue was found during a review of Wentao Liang's patch referenced below.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade kernel to a version that resolves this vulnerability.
Patch mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

Event History

Oct 23, 2026

Advisory Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98948

Frequently Asked Questions

Which systems are exposed to this resource leak?

Systems using the mlxsw Spectrum flower offload path are exposed when flow classifier offload templates with port ranges are parsed. The leak concerns port range registers acquired during template creation.

What activity triggers the leak?

Creating a flow_cls_offload template that causes mlxsw_sp_flower_parse_ports_range() to acquire port range registers can trigger it. The stack-local rule information used during template parsing was not destroyed, so the acquired registers were not released.

Does deleting the chain template release the leaked registers?

No. The description states that the registers were never released, including through chain template deletion.

AZL-110753: CVE-2026-98948 affecting package kernel 6.6.157.1-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this resource leak?

What activity triggers the leak?

Does deleting the chain template release the leaked registers?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this resource leak?

What activity triggers the leak?

Does deleting the chain template release the leaked registers?