In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace()… (CVE-2026-99029)

The Linux kernel's sparx5 driver had a vulnerability where sparx5_tc_matchall_replace() allocated a sparx5_mall_entry struct for each offloaded matchall filter and added it to sparx5->mall_entries. However, sparx5_tc_matchall_destroy() removed the entry from the list but did not free the allocated memory, resulting in a memory leak for every deleted mirror and goto matchall filter. This leak was identified by an AI code review agent and confirmed using kmemleak on a lan969x EV board by repeatedly adding and deleting matchall mirror and goto filters. The patch frees the entry after unlinking it, eliminating the leak.

The vulnerability causes a memory leak in the Linux kernel sparx5 driver when matchall filters are repeatedly added and deleted. This could lead to increased memory usage and potential resource exhaustion over time. There is no indication of direct exploitation or other impacts such as privilege escalation or denial of service beyond the leak.

A fix has been implemented in the Linux kernel to free the allocated matchall entries after unlinking them, preventing the memory leak. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.