CVE-2026-99029

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the entry from the list, but never frees it, so the entry of every deleted mirror and goto matchall filter is leaked. Free the entry after unlinking it. The leak was discovered by an AI code review agent, and reproduced with kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and deleting matchall mirror and goto filters. With the fix, kmemleak no longer reports the leak.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-23 13:17:25.963000

Last modified

2026-10-23 13:17:25.963000

View original CVE JSON

{
  "id": "CVE-2026-99029",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-23T13:17:25.963",
  "lastModified": "2026-10-23T13:17:25.963",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: free the matchall entry on destroy\n\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5->mall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\n\nFree the entry after unlinking it.\n\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42",
              "lessThan": "fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42",
              "lessThan": "cc7cc5955d22ea90555f09a680d4bf56d4a0c24a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42",
              "lessThan": "44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1ede4acf045ced70d9b72465e2e968aec71e0a42",
              "lessThan": "2b82e16d6084cbc651e3c902198f1945408ee1a5",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.57",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.11",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2b82e16d6084cbc651e3c902198f1945408ee1a5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc7cc5955d22ea90555f09a680d4bf56d4a0c24a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}