{"id":"CVE-2026-98895","state":"PUBLISHED","title":"net/mlx5: HWS, Handle destroying table that has a miss table","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Handle destroying table that has a miss table\n\nIf a table has a miss table that was created by\n'mlx5hws_table_set_default_miss' API function, its miss_tbl\nkeeps the table that points to it in a list.\nIf such table is deleted, we need to also remove it from the\nmiss_tbl list, otherwise the node in miss_tbl list will contain\ngarbage.","publishedAt":"2026-10-23T11:37:56.618Z","updatedAt":"2026-10-26T06:56:21.757Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9fc43b5e3933a7e5924ba83d7561399d439de5bb","status":"affected","lessThan":"6efdc212627cecf33b594256ae4460b4c52a126a","versionType":"git"},{"version":"9fc43b5e3933a7e5924ba83d7561399d439de5bb","status":"affected","lessThan":"60e9e82f162ab7399373ff2185119289e4f6dc06","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c"]}],"references":["https://git.kernel.org/stable/c/6efdc212627cecf33b594256ae4460b4c52a126a","https://git.kernel.org/stable/c/60e9e82f162ab7399373ff2185119289e4f6dc06"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98895.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98895","state":"PUBLISHED","datePublished":"2026-10-23T11:37:56.618Z","dateUpdated":"2026-10-26T06:56:21.757Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.378Z"},"containers":{"cna":{"title":"net/mlx5: HWS, Handle destroying table that has a miss table","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Handle destroying table that has a miss table\n\nIf a table has a miss table that was created by\n'mlx5hws_table_set_default_miss' API function, its miss_tbl\nkeeps the table that points to it in a list.\nIf such table is deleted, we need to also remove it from the\nmiss_tbl list, otherwise the node in miss_tbl list will contain\ngarbage."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9fc43b5e3933a7e5924ba83d7561399d439de5bb","status":"affected","lessThan":"6efdc212627cecf33b594256ae4460b4c52a126a","versionType":"git"},{"version":"9fc43b5e3933a7e5924ba83d7561399d439de5bb","status":"affected","lessThan":"60e9e82f162ab7399373ff2185119289e4f6dc06","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6efdc212627cecf33b594256ae4460b4c52a126a"},{"url":"https://git.kernel.org/stable/c/60e9e82f162ab7399373ff2185119289e4f6dc06"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - RTM_NEWTFILTER/RTM_DELTFILTER reaches tc_new_tfilter/tc_del_tfilter, mlx5e flower offload, mlx5_destroy_flow_table(), and the patched mlx5hws_table_destroy(); network packets only traverse installed rules and cannot create the stale list node.\nAC:H - mlx5_cmd_hws_destroy_flow_table() normally removes the miss link through mlx5_fs_set_ft_default_miss(NULL); the stale node requires its mlx5hws_cmd_flow_table_modify() disconnect to fail while destruction continues, a firmware/device condition the TC actor cannot reliably induce.\nPR:L - rtnetlink_rcv_msg() gates RTM_*TFILTER with netlink_net_capable(CAP_NET_ADMIN), which uses the socket network namespace's user_ns. CAP_NET_ADMIN in a delegated netns containing an mlx5 representor suffices; mlx5e_setup_tc_block_cb() adds no init-user-namespace check.\nUI:N - Once an HMFS switchdev device is configured, the TC actor can issue the filter deletion and subsequent table or matcher operation directly; no action by another user is required.\nS:U - The dangling mlx5hws_table is consumed within the host mlx5 driver and kernel allocator; exploitation affects the same kernel security authority rather than crossing a VM, IOMMU, or other scope boundary.\nC:H - mlx5hws_table_update_connected_miss_tables() treats the freed list entry as a live src_tbl and dereferences its ctx, matchers_list, IDs, and other pointers, giving a reclaim-and-spray attacker UAF-based kernel-memory read potential.\nI:H - list_add() can write a new-node pointer through the stale freed list entry, and mlx5hws_table_connect_to_miss_table() later writes src_tbl->default_miss.miss_tbl through that UAF; controlled slab reuse can convert these writes into exploitable heap corruption.\nA:H - Walking the freed default_miss.next entry and dereferencing a reclaimed src_tbl can corrupt list state or fault on bogus ctx and matcher pointers, causing a kernel oops or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-26T06:56:21.757Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}