CVE-2026-98908: net: microchip: sparx5: clean up PSFP resources on flower setup failure
In the Linux kernel, the following vulnerability has been resolved:
net: microchip: sparx5: clean up PSFP resources on flower setup failure
sparx5tcflowerpsfpsetup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound.
Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired.
Also make sparx5psfpfmadd() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5psfpfmget() increments its pool reference count, but the caller previously kept psfpfmid as 0. If a later setup step failed, the error path could try to delete flow-meter id 0 instead of the reused flow meter, leaving the incremented reference behind.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update sparx5_tc_flower_psfp_setup() to unwind PSFP resources on setup failure by releasing the acquired stream filter, flow meter, and stream gate; ensure sparx5_psfp_fm_add() returns the acquired flow-meter ID, including before the existing-flow-meter early return, so cleanup deletes the reused flow meter rather than ID 0.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Microchip Sparx5 driver are affected when PSFP resources are configured through the flower setup path. The failure condition must occur after a stream gate, flow meter, or stream filter has been acquired and before setup completes.
What happens when the affected setup operation fails?
Previously acquired PSFP resources may not be released. When an existing flow meter is reused, its reference count can remain incremented because the cleanup path may attempt to delete flow-meter ID 0 rather than the reused meter.