Skip to main content

Linux EUVDEUVD-2026-103738

| CVE-2026-98498
2026-10-18 Linux GHSA-j7wh-6jqc-vrfw
View
Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.

Affected VersionsENISA

Linux patch: 7.2.9
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <1f13989a0704bd98cab09f9bee63e2c8a98ad4dd
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <79a3257280a335bbebbcd10d3895e8468bdcd6ae
Linux patch: 5.10.271
Linux patch: 6.12.112
Linux patch: 0
Linux patch: 7.3-rc5
Linux patch: 6.18.55
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <598daa5f95883f881a54967da40ce0fdfc1fdaa8
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <60eab87d0a798070bf5a856b1d9e5785ce92da53
Linux 5.10
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <288721013605b4e0304e10f6a087b77f71cfad11
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <0bf6bb567f0edaa771e7dd208ef98da50e6a4485
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <99d8dc51663747078c031acac32edc6d90c8f1f7
Linux patch: 6.6.158
Linux patch: 5.15.222
Linux 1edae2335adfa7006853e8b427f0c7c3f46b51dd <c45c997d0c27359b502587897f775c5a277f0bd4
Linux patch: 6.1.189

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Oct 18, 2026 - 16:02 EUVD
CVE Published
Oct 18, 2026 - 15:16 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy