Linux kernel CVE-2026-98895

Exploitation requires a host running the mlx5 driver on NVIDIA/Mellanox ConnectX hardware with HWS (hardware steering) in use, specifically a configuration where a miss table has been created through the mlx5hws_table_set_default_miss API and a table referencing it is subsequently destroyed - that destroy-with-miss-table path is the trigger. The attacker must be local (AV:L) and already possess the privilege to create and destroy flow-steering tables (PR:L, in practice CAP_NET_ADMIN or equivalent). Limiting factors that reduce realistic risk: it is not remotely reachable, attack complexity is High (AC:H), it is gated on non-default specialized hardware and the HWS feature actually being exercised, and no user interaction by a victim is involved (it is attacker-driven from a privileged local context).

Signals converge on this being a genuine but low-urgency, non-internet-facing issue rather than a mass-exploitation threat. The CVSS 3.1 base score of 7.0 (High) is driven entirely by the full C:H/I:H/A:H impact of kernel memory corruption, but the exploitability metrics heavily constrain it: AV:L (local only, not remotely reachable), AC:H (high attack complexity), PR:L (requires existing low-level privilege), UI:N, S:U. EPSS reinforces this low real-world threat at 0.21% (10th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis - the only references are the three kernel.org stable fix commits, which are patches, not PoC. The vuln.today decision label is 'this_week', consistent with a High-severity kernel fix that should be rolled in during the normal patch cycle rather than as an emergency. One conflict to flag: the input Tag 'Information Disclosure' understates the issue - the description is a dangling/garbage list node (a use-after-free-class memory-safety bug) and the vector asserts C:H/I:H/A:H, i.e. integrity and availability impact, not confidentiality alone; verify intended impact with the kernel changelog. Net: a real High-severity local kernel flaw that is a low priority for most fleets because it is local-only, high-complexity, and gated on specific Mellanox/mlx5 hardware steering being in use.

A local user or container tenant that already holds the privilege to manage mlx5 flow-steering tables (typically CAP_NET_ADMIN) creates a miss table via the mlx5hws_table_set_default_miss API, then deletes a table that points to it, leaving a garbage list node in the miss_tbl list that the kernel later dereferences. Given AV:L and AC:H, this is not a drive-by remote attack but a local attempt to corrupt kernel memory for crash (DoS) or potential privilege escalation. No public exploit identified at time of analysis.