CVE-2026-99029 Linux CVE debrief

Who should care

Linux system administrators, maintainers, and users of affected systems should assess exposure and prioritize verification and patching. This includes reviewing system configurations, applying patches, and monitoring system memory usage to prevent potential issues related to the memory leak vulnerability.

Why it matters

CVE-2026-99029 is a memory leak vulnerability in the Linux kernel's net: sparx5 component. Linux system administrators and maintainers should assess exposure and prioritize verification of affected systems, especially those with unpatched or outdated kernels.

• Memory leak can lead to increased memory usage and potential system crashes
• Verification of affected systems and patching is necessary to prevent potential issues

Technical summary

The Linux kernel's net: sparx5 component has a memory leak vulnerability due to a missing free operation when deleting matchall filters. This issue was introduced by the commit 1ede4acf045ced70d9b72465e2e968aec71e0a42 and was fixed by the commits fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e, cc7cc5955d22ea90555f09a680d4bf56d4a0c24a, 44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e, and 2b82e16d6084cbc651e3c902198f1945408ee1a5. Linux system administrators and maintainers should assess exposure and prioritize verification of affected systems, especially those with unpatched or outdated kernels.

Defensive priority

Linux system administrators and maintainers should assess exposure and prioritize verification of affected systems, especially those with unpatched or outdated kernels.

Recommended defensive actions

• Verify Linux kernel versions and assess exposure to CVE-2026-99029
• Apply patches from Linux kernel maintainers to fix the memory leak
• Monitor system memory usage to detect potential issues related to the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The memory leak was discovered by an AI code review agent and reproduced with kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and deleting matchall mirror and goto filters. This vulnerability was fixed by several commits, including fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e and 2b82e16d6084cbc651e3c902198f1945408ee1a5. Linux system administrators should verify affected systems and apply patches to prevent potential memory leak issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.