Answer in brief
CVE-2026-98948 records a Unknown severity vulnerability in mlxsw: spectrum_flower: Fix port range register leak in tmplt_create(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=fe22f7410527c2077223b5fd0fc0458db912f0db <41ad5bcf0219aaebf8ffb052c5e8177479330cde || >=fe22f7410527c2077223b5fd0fc0458db912f0db <c8e934287debb29c6ded86b21e49fc72e186d15e || >=fe22f7410527c2077223b5fd0fc0458db912f0db <3938430f0237c59ca08d6a366e7657b2b7f8d0bb || >=fe22f7410527c2077223b5fd0fc0458db912f0db <4eaf1285b5c1e42f80e47f9fe0d391e70418db02 || >=fe22f7410527c2077223b5fd0fc0458db912f0db <7ea07afb230f1342ab0f9365edd0aae137f425d3 | 41ad5bcf0219aaebf8ffb052c5e8177479330cde, c8e934287debb29c6ded86b21e49fc72e186d15e, 3938430f0237c59ca08d6a366e7657b2b7f8d0bb, 4eaf1285b5c1e42f80e47f9fe0d391e70418db02, 7ea07afb230f1342ab0f9365edd0aae137f425d3 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak. The issue was found during a review of Wentao Liang's patch referenced below.
Quoted source text, attributed separately from HOL analysis.