SB20261023228 - Missing Release of Resource after Effective Lifetime in Linux kernel mellanox mlxsw driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023228

SB20261023228 - Missing Release of Resource after Effective Lifetime in Linux kernel mellanox mlxsw driver

Published: October 23, 2026

Security Bulletin ID SB20261023228
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to exhaust port range register resources and potentially cause a denial of service.

The vulnerability exists due to missing release of port range register resources in mlxsw_sp_flower_tmplt_create() when parsing flow classification offload templates containing port ranges. A local privileged user can repeatedly trigger creation of these templates to accumulate unreleased register allocations and potentially prevent subsequent operations that require those resources.


Remediation

Install update from vendor's website.

References