Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98908

Vulnerability details

The vulnerability allows a local privileged user to exhaust packet-filtering resources and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated resources in the Linux kernel's Microchip Sparx5 PSFP setup code when traffic-control flower setup fails after acquiring resources. A local privileged user can trigger repeated failing setup operations to leave stream gates, flow meters, or stream filters allocated and potentially exhaust resources needed for subsequent filtering operations. Reusing an existing flow meter can also leave its reference count incremented because sparx5_psfp_fm_add() does not return the acquired identifier before its early return.

Affected software

How to mitigate CVE-2026-98908

External References

• https://git.kernel.org/stable/c/46e50367338702abe3df661df7795bdada40fef7
• https://git.kernel.org/stable/c/640c1bd8d359ad34817f5afec0872985e87b49ec
• https://git.kernel.org/stable/c/a46ea3f7ee0d3ad3d5e92043232b293be2a305d3
• https://git.kernel.org/stable/c/a7625d408f7f0535c2b0f05d53231d6496acd48b

Related Security Bulletins

• Missing Release of Resource after Effective Lifetime in Linux kernel microchip sparx5 driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more