SB2026102423 - Missing Release of Resource after Effective Lifetime in Linux kernel microchip sparx5 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98908)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust packet-filtering resources and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated resources in the Linux kernel's Microchip Sparx5 PSFP setup code when traffic-control flower setup fails after acquiring resources. A local privileged user can trigger repeated failing setup operations to leave stream gates, flow meters, or stream filters allocated and potentially exhaust resources needed for subsequent filtering operations. Reusing an existing flow meter can also leave its reference count incremented because sparx5_psfp_fm_add() does not return the acquired identifier before its early return.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/46e50367338702abe3df661df7795bdada40fef7
• https://git.kernel.org/stable/c/640c1bd8d359ad34817f5afec0872985e87b49ec
• https://git.kernel.org/stable/c/a46ea3f7ee0d3ad3d5e92043232b293be2a305d3
• https://git.kernel.org/stable/c/a7625d408f7f0535c2b0f05d53231d6496acd48b