HomeDefectsLIN1025-25734
Acknowledged

LIN1025-25734 : Security Advisory - linux - CVE-2026-98948

Created: Oct 23, 2026    Updated: Oct 27, 2026
Resolved Date: Oct 23, 2026
Found In Version: 10.25.33.2
Severity: Standard
Applicable for: Wind River Linux LTS 25
Component/s: Kernel

Description

In the Linux kernel, the following vulnerability has been resolved:  mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()  mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion.  Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak.  The issue was found during a review of Wentao Liang's patch referenced below.