CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput
In mlx5eswitchtermtblput(), the zero-ref cleanup check reads tt->refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle race: one decrements refcount to zero, removes the hash entry, and calls kfree(tt) while the other has already dropped the mutex and is about to evaluate if (!tt->refcount), producing a use-after-free.
Fix this by capturing the result of the decrement into a stack-local last variable before dropping the mutex. The cleanup decision is now made entirely under termtblmutex, and tt is not touched after kfree.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the race?
Two concurrent callers must operate on the same mlx5_termtbl_handle in mlx5_eswitch_termtbl_put(). One caller can reduce the reference count to zero and free the term-table object while the other caller evaluates the reference count after releasing the mutex.
How can I determine whether a kernel includes the fix?
The corrected implementation stores the decrement result in a stack-local last variable before releasing termtbl_mutex, and bases cleanup on that saved result. The provided stable-kernel references identify commits containing the fix.
What is the immediate mitigation if a fixed kernel cannot be deployed?
No configuration workaround or operational mitigation is provided in the available information. Reducing or avoiding concurrent use of the same mlx5 term-table handle would address the described race condition, but the data does not specify a supported way to do so.