{"id":29169,"date":"2026-09-25T20:32:02","date_gmt":"2026-09-25T12:32:02","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98014"},"modified":"2026-09-25T20:32:02","modified_gmt":"2026-09-25T12:32:02","slug":"cve-2026-98014","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98014","title":{"rendered":"CVE-2026-98014 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/mlx5: E-Switch, p"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/mlx5: E-Switch, prevent mc_list repopulation during vport disable<\/p>\n<p>In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead<br \/>\nof esw_vport_change_handle_locked() so vport-&gt;allmulti_rule is<br \/>\nNULL before the change handler observes it.<\/p>\n<p>During FW-fatal recovery the disable runs while dev-&gt;state ==<br \/>\nINTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode()<br \/>\nfails and returns early, leaving vport-&gt;allmulti_rule intact, so<br \/>\nesw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries<br \/>\nto vport-&gt;mc_list whose flow rules are then installed in the FDB<br \/>\nby esw_add_mc_addr(). esw_destroy_legacy_table() tears down the<br \/>\nFDB with those refs still held, corrupting the sub-tree and<br \/>\nleaving dangling flow_rule pointers in vport-&gt;mc_list.<\/p>\n<p>Two-stage failure on `echo 1 &gt; \/sys\/bus\/pci\/devices\/\/reset`:<\/p>\n<p>  refcount_t: underflow; use-after-free.<br \/>\n   tree_put_node+0xef\/0x110 [mlx5_core]<br \/>\n   clean_tree+0x44\/0xd0 [mlx5_core] (x5)<br \/>\n   mlx5_fs_core_cleanup+0x57\/0x1c0 [mlx5_core]<br \/>\n   mlx5_unload+0x65\/0xd0 [mlx5_core]<br \/>\n   &#8230; mlx5_health_try_recover<\/p>\n<p>  BUG: unable to handle page fault for address: 0000000003000055<br \/>\n   down_write+0x1c\/0x60<br \/>\n   mlx5_del_flow_rules+0x33\/0x1f0 [mlx5_core]<br \/>\n   esw_del_mc_addr+0x7b\/0x170 [mlx5_core]<br \/>\n   esw_apply_vport_addr_list+0x56\/0xf0 [mlx5_core]<br \/>\n   esw_vport_change_handle_locked+0x28b\/0x310 [mlx5_core]<br \/>\n   mlx5_esw_vport_enable+0x270\/0x4a0 [mlx5_core]<br \/>\n   &#8230; mlx5_load &#8230; mlx5_health_try_recover<\/p>\n<p>esw_apply_vport_rx_mode(false, false) clears vport-&gt;allmulti_rule<br \/>\nvia its local state machine even when the FW del fails. With the<br \/>\nrule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change<br \/>\nhandler closes, no rules are installed during disable, and the<br \/>\nreload starts with a clean mc_list.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/mlx5: E-Switch, prevent mc_list repopulation during vport disable<\/p>\n<p>In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29169","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}