CVE-2026-98014 Linux CVE debrief

Who should care

Linux kernel users who utilize the mlx5_core module should assess their exposure to this vulnerability and apply patches as necessary. The vulnerability may impact Linux kernel users who utilize the mlx5_core module. Linux kernel users should assess their exposure to this vulnerability and apply patches as necessary.

Why it matters

This vulnerability in the Linux kernel's net/mlx5 E-Switch can lead to system crashes and potential security risks if not patched. Linux kernel users should assess their exposure and apply patches as necessary.

• Potential system crashes due to use-after-free and refcount_t underflow errors.
• Verification of system configurations to prevent exploitation.
• Patching Linux kernel to prevent potential security risks.

Technical summary

The vulnerability is related to the net/mlx5 E-Switch in the Linux kernel. The issue arises during FW-fatal recovery when the disable runs while dev->state == INTERNAL_ERROR. This leads to incorrect handling of vport->allmulti_rule, causing a use-after-free and refcount_t underflow errors. The vulnerability may impact Linux kernel users who utilize the mlx5_core module. Linux kernel users should assess their exposure to this vulnerability and apply patches as necessary. The issue prevented mc_list repopulation during vport disable.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to prevent potential use-after-free and refcount_t underflow errors.
• Monitor Linux kernel updates for any related security patches.
• Verify system configurations to ensure they are not exposed to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions is not explicitly stated, requiring further verification. The vulnerability is related to the net/mlx5 E-Switch in the Linux kernel. The issue arises during FW-fatal recovery when the disable runs while dev->state == INTERNAL_ERROR. This leads to incorrect handling of vport->allmulti_rule, causing a use-after-free and refcount_t underflow errors. Linux kernel users who utilize the mlx5_core module should assess their

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.