CVE-2026-98014

An ordering flaw in mlx5 E-Switch vport shutdown can repopulate mc_list with FDB flow rules while the device is in INTERNAL_ERROR state. The subsequent FDB teardown leaves dangling flow_rule pointers and corrupts steering tree reference counts. A later recovery or reload can traverse these stale entries and trigger a refcount underflow, use-after-free, page fault, and kernel crash. For the CVSS the PR:L value is used in the paranoid assessment because some SR-IOV environments delegate VF or vport management to a reduced capability tenant or service account that may influence the recovery sequence. The directly documented PCI reset trigger normally requires administrative privileges and therefore the base assessment uses PR:H. The issue is not proven to be directly network reachable because ordinary traffic alone does not initiate the required firmware fatal recovery and device reload sequence. Impact is at least local denial of service. The concrete dangling pointer and use-after-free condition may also permit confidentiality or integrity impact and possible privilege escalation if the freed object can be reused in a controlled manner.