CVE-2026-98948

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 23, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion.

Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak.

The issue was found during a review of Wentao Liang's patch referenced below.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fe22f7410527c2077223b5fd0fc0458db912f0db to before 41ad5bcf0219aaebf8ffb052c5e8177479330cdeAffected fe22f7410527c2077223b5fd0fc0458db912f0db to before c8e934287debb29c6ded86b21e49fc72e186d15eAffected fe22f7410527c2077223b5fd0fc0458db912f0db to before 3938430f0237c59ca08d6a366e7657b2b7f8d0bbAffected fe22f7410527c2077223b5fd0fc0458db912f0db to before 4eaf1285b5c1e42f80e47f9fe0d391e70418db02Affected fe22f7410527c2077223b5fd0fc0458db912f0db to before 7ea07afb230f1342ab0f9365edd0aae137f425d3Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

fe22f7410527c2077223b5fd0fc0458db912f0db to before 41ad5bcf0219aaebf8ffb052c5e8177479330cdeAffected
fe22f7410527c2077223b5fd0fc0458db912f0db to before c8e934287debb29c6ded86b21e49fc72e186d15eAffected
fe22f7410527c2077223b5fd0fc0458db912f0db to before 3938430f0237c59ca08d6a366e7657b2b7f8d0bbAffected
fe22f7410527c2077223b5fd0fc0458db912f0db to before 4eaf1285b5c1e42f80e47f9fe0d391e70418db02Affected
fe22f7410527c2077223b5fd0fc0458db912f0db to before 7ea07afb230f1342ab0f9365edd0aae137f425d3Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.