SB20261023141 - Memory leak in Linux kernel microchip sparx5 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-99029)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to consume kernel memory and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated memory in sparx5_tc_matchall_destroy() when deleting offloaded matchall filters. A local privileged user can repeatedly add and delete mirror and goto matchall filters to accumulate leaked allocations and potentially degrade system availability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2b82e16d6084cbc651e3c902198f1945408ee1a5
• https://git.kernel.org/stable/c/44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e
• https://git.kernel.org/stable/c/cc7cc5955d22ea90555f09a680d4bf56d4a0c24a
• https://git.kernel.org/stable/c/fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e