In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure… (CVE-2026-98908)

The Linux kernel vulnerability CVE-2026-98908 concerns the Microchip Sparx5 network driver, where the function sparx5_tc_flower_psfp_setup() allocates several PSFP resources (stream gate, flow meter, stream filter) before adding VCAP actions. If a failure occurs after resource allocation, the function did not properly release these resources, causing resource leaks. Furthermore, sparx5_psfp_fm_add() was modified to correctly return the acquired flow-meter ID to prevent errors in reference counting and deletion logic when reusing existing flow meters. This fix ensures that resources are properly cleaned up on setup failure, preventing potential resource exhaustion or inconsistent state.

The vulnerability could lead to resource leaks within the kernel's network driver, potentially causing degraded system performance or instability due to unreleased PSFP resources. Incorrect reference counting might also cause improper deletion attempts, further risking kernel resource mismanagement. There is no indication of direct exploitation or broader impact such as privilege escalation or denial of service beyond resource leakage.

A fix has been implemented in the Linux kernel to address this issue by adding error handling paths that release allocated PSFP resources upon setup failure and correcting flow meter ID handling. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly confirmed in the provided data; therefore, verify the vendor advisory or Linux kernel mailing lists for the exact fixed versions and apply updates accordingly.