CVE-2026-98014

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead of esw_vport_change_handle_locked() so vport->allmulti_rule is NULL before the change handler observes it.

During FW-fatal recovery the disable runs while dev->state == INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode() fails and returns early, leaving vport->allmulti_rule intact, so esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries to vport->mc_list whose flow rules are then installed in the FDB by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the FDB with those refs still held, corrupting the sub-tree and leaving dangling flow_rule pointers in vport->mc_list.

Two-stage failure on `echo 1 > /sys/bus/pci/devices/<bdf>/reset`:

refcount_t: underflow; use-after-free. tree_put_node+0xef/0x110 [mlx5_core] clean_tree+0x44/0xd0 [mlx5_core] (x5) mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core] mlx5_unload+0x65/0xd0 [mlx5_core] ... mlx5_health_try_recover

BUG: unable to handle page fault for address: 0000000003000055 down_write+0x1c/0x60 mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core] esw_del_mc_addr+0x7b/0x170 [mlx5_core] esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core] esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core] mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core] ... mlx5_load ... mlx5_health_try_recover

esw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule via its local state machine even when the FW del fails. With the rule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change handler closes, no rules are installed during disable, and the reload starts with a clean mc_list.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4df1f2d36bdc9a368650bf14b9097c555e95f71d to before 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9Affected 63546395a0e6ac264f78f65218086ce6014b4494 to before 2196f9d3358b00fcb28835a5fde14071f51ecb96Affected 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 5a2b87dfceccf9065157a14a599d395c2b6281b8Affected 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 69904608e25e8ba58111aadd9210892cf3876201Affected 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 72cfcb79026cffb6490f5044153a841d360b0cfcAffected 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 668e050429c7ca688cf4e7112f97f0cd269d446bAffected 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before c0c6f4ba8a37688f7b4d4044898d88f0450d44c2Affected 18cead61e437f4c7898acca0a5f3df12f801d97fAffected 6f5780536181d1d0d09a11a1bc92f22e143447e2Affected 5.15.105 to before 5.15.222Affected 6.1.22 to before 6.1.189Affected 5.10.177 to before 5.11Affected 6.2.9 to before 6.3Affected
LinuxLinux	6.3Affected before 6.3Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4df1f2d36bdc9a368650bf14b9097c555e95f71d to before 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9Affected
63546395a0e6ac264f78f65218086ce6014b4494 to before 2196f9d3358b00fcb28835a5fde14071f51ecb96Affected
922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 5a2b87dfceccf9065157a14a599d395c2b6281b8Affected
922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 69904608e25e8ba58111aadd9210892cf3876201Affected
922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 72cfcb79026cffb6490f5044153a841d360b0cfcAffected
922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before 668e050429c7ca688cf4e7112f97f0cd269d446bAffected
922f56e9a795d6f3dd72d3428ebdd7ee040fa855 to before c0c6f4ba8a37688f7b4d4044898d88f0450d44c2Affected
18cead61e437f4c7898acca0a5f3df12f801d97fAffected
6f5780536181d1d0d09a11a1bc92f22e143447e2Affected
5.15.105 to before 5.15.222Affected
6.1.22 to before 6.1.189Affected
5.10.177 to before 5.11Affected
6.2.9 to before 6.3Affected

LinuxLinux

6.3Affected
before 6.3Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.