CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put()
Published Sep 25, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix use-after-free race in samplerestoreput()
Concurrent teardown of TC sample rules sharing the same restore context may re-read restore->count after dropping restorelock. At that point another thread may already have completed cleanup and freed the restore object.
Use the result of the refcount decrement while holding restorelock to determine whether cleanup is needed.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 25, 2026
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
Description
Data Sourced
via NVD·11:17 AM
Description
Frequently Asked Questions
1
Which deployments are exposed to this race condition?
The race is associated with concurrent teardown of TC sample rules that share the same restore context in the Linux kernel mlx5e networking code.