VulnerabilityPublished 23 Oct 2026

CVE-2026-99029: Linux kernel · net: sparx5: free the matchall entry on destroy

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:18 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e, cc7cc5955d22ea90555f09a680d4bf56d4a0c24a, 44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e +1

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e, cc7cc5955d22ea90555f09a680d4bf56d4a0c24a, 44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e or 2b82e16d6084cbc651e3c902198f1945408ee1a5.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1ede4acf045ced70d9b72465e2e968aec71e0a42, < fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e	Fixed in fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e
LinuxLinux	Affected ≥ 1ede4acf045ced70d9b72465e2e968aec71e0a42, < cc7cc5955d22ea90555f09a680d4bf56d4a0c24a	Fixed in cc7cc5955d22ea90555f09a680d4bf56d4a0c24a
LinuxLinux	Affected ≥ 1ede4acf045ced70d9b72465e2e968aec71e0a42, < 44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e	Fixed in 44efb6d92dd5a2b1dd9553d92ef0eebde135fc6e
LinuxLinux	Affected ≥ 1ede4acf045ced70d9b72465e2e968aec71e0a42, < 2b82e16d6084cbc651e3c902198f1945408ee1a5	Fixed in 2b82e16d6084cbc651e3c902198f1945408ee1a5
LinuxLinux	Affected =6.10	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented and is available in the Linux kernel source code (commits fa0c27d9e17ee2e46d4b8274a6fde706f0d6725e and others). Users should update to a patched kernel version that includes these fixes to resolve the memory leak. No additional mitigation steps are indicated.

Description

A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed by ensuring that allocated matchall entries are properly freed upon destruction. The flaw caused memory allocated for offloaded matchall filters to be leaked when these filters were deleted. This issue was identified and confirmed through testing with kmemleak on specific hardware. The fix involves freeing the allocated entries after unlinking them from the internal list.

Impact

The vulnerability causes a memory leak in the kernel's sparx5 driver when matchall filters are repeatedly added and deleted. This could lead to increased memory consumption and potential resource exhaustion over time on affected systems. There is no indication of direct exploitation or other impacts such as privilege escalation or denial of service beyond the leak.

Summary

CVE-2026-99029 addresses a memory leak in the Linux kernel's sparx5 driver related to matchall filter management. The function sparx5_tc_matchall_replace() allocates a sparx5_mall_entry struct for each offloaded matchall filter and adds it to a list. However, sparx5_tc_matchall_destroy() removes the entry from the list without freeing the allocated memory, resulting in a leak for every deleted mirror and goto matchall filter. The issue was discovered by an AI code review agent and reproduced using kmemleak on a lan969x EV board. The patch ensures that the entry is freed after being unlinked, preventing the memory leak.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 09:58 UTC

Technical details

References

Community reviews

Related threats