Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98948

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak. The issue was found during a review of Wentao Liang's patch referenced below.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fe22f7410527c2077223b5fd0fc0458db912f0db to < 41ad5bcf0219aaebf8ffb052c5e8177479330cdeaffected
  • fe22f7410527c2077223b5fd0fc0458db912f0db to < c8e934287debb29c6ded86b21e49fc72e186d15eaffected
  • fe22f7410527c2077223b5fd0fc0458db912f0db to < 3938430f0237c59ca08d6a366e7657b2b7f8d0bbaffected
  • fe22f7410527c2077223b5fd0fc0458db912f0db to < 4eaf1285b5c1e42f80e47f9fe0d391e70418db02affected
  • fe22f7410527c2077223b5fd0fc0458db912f0db to < 7ea07afb230f1342ab0f9365edd0aae137f425d3affected

Linux Linux

Default version status: affected

  • 6.6affected
  • 0 to < 6.6unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References