Is there a patch available for CVE-2026-98014?

Yes, a patch is available for CVE-2026-98014. Update the affected software to the latest version immediately.

Linux CVE-2026-98014

EUVD-2026-86667

2026-09-25 Linux

GHSA-hjxx-jpr5-hfgw

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: E-Switch, prevent mc_list repopulation during vport disable

In mlx5_esw_vport_disable(), move esw_apply_vport_rx_mode() ahead of esw_vport_change_handle_locked() so vport->allmulti_rule is NULL before the change handler observes it.

During FW-fatal recovery the disable runs while dev->state == INTERNAL_ERROR. The promisc query inside esw_update_vport_rx_mode() fails and returns early, leaving vport->allmulti_rule intact, so esw_update_vport_mc_promisc() runs and adds MLX5_ACTION_ADD entries to vport->mc_list whose flow rules are then installed in the FDB by esw_add_mc_addr(). esw_destroy_legacy_table() tears down the FDB with those refs still held, corrupting the sub-tree and leaving dangling flow_rule pointers in vport->mc_list.

Two-stage failure on echo 1 > /sys/bus/pci/devices/<bdf>/reset:

refcount_t: underflow; use-after-free. tree_put_node+0xef/0x110 [mlx5_core] clean_tree+0x44/0xd0 [mlx5_core] (x5) mlx5_fs_core_cleanup+0x57/0x1c0 [mlx5_core] mlx5_unload+0x65/0xd0 [mlx5_core] ... mlx5_health_try_recover

BUG: unable to handle page fault for address: 0000000003000055 down_write+0x1c/0x60 mlx5_del_flow_rules+0x33/0x1f0 [mlx5_core] esw_del_mc_addr+0x7b/0x170 [mlx5_core] esw_apply_vport_addr_list+0x56/0xf0 [mlx5_core] esw_vport_change_handle_locked+0x28b/0x310 [mlx5_core] mlx5_esw_vport_enable+0x270/0x4a0 [mlx5_core] ... mlx5_load ... mlx5_health_try_recover

esw_apply_vport_rx_mode(false, false) clears vport->allmulti_rule via its local state machine even when the FW del fails. With the rule NULL the !IS_ERR_OR_NULL(allmulti_rule) gate in the change handler closes, no rules are installed during disable, and the reload starts with a clean mc_list.

Affected VersionsENISA

Linux patch: 7.3-rc3

Linux 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 <69904608e25e8ba58111aadd9210892cf3876201

Linux patch: 0

Linux 63546395a0e6ac264f78f65218086ce6014b4494

Linux 6f5780536181d1d0d09a11a1bc92f22e143447e2

Linux 6.3

Linux 4df1f2d36bdc9a368650bf14b9097c555e95f71d

Linux 6.1.22 <6.2

Linux patch: 6.18.53

Linux 5.15.105 <5.16

Linux 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 <668e050429c7ca688cf4e7112f97f0cd269d446b

Linux patch: 7.2.7

Linux patch: 6.12.111

Linux 5.10.177 <5.11

Linux 6.2.9 <6.3

Linux 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 <72cfcb79026cffb6490f5044153a841d360b0cfc

Linux 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 <c0c6f4ba8a37688f7b4d4044898d88f0450d44c2

Linux 18cead61e437f4c7898acca0a5f3df12f801d97f

Affected Packages

euvd linux fix: 5.11, 5.16, 6.2, 6.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Sep 25, 2026 - 11:02 EUVD

CVE Published

Sep 25, 2026 - 10:23 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.