CVE-2026-98015

A race in mlx5_eswitch_termtbl_put can access a termination table handle after another caller has reduced its reference count to zero and freed it. Two concurrent callers can also both observe the zero reference count and attempt to delete the same flow rule, destroy the same flow table, and free the same object. This creates a use-after-free and a plausible double cleanup or double-free condition that may crash the kernel and could potentially support privilege escalation through kernel memory corruption. For the CVSS the PR:L value is used for the paranoid score because mlx5 E-Switch control may be delegated to a container root or a service account with network administration capabilities, even though normal host configuration usually requires higher administrative privileges. AC:H applies because reliable triggering depends on winning a concurrency window between two cleanup operations. The issue is not directly network reachable through ordinary packet traffic and normally requires local access to the mlx5 E-Switch control plane. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality and integrity compromise due to the plausible double-free condition.