---
id: CVE-2026-98908
title: 'net: microchip: sparx5: clean up PSFP resources on flower setup failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: microchip: sparx5: clean up PSFP resources on flower setup failure

  sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and
  stream filter resource…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a7625d408f7f0535c2b0f05d53231d6496acd48b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a46ea3f7ee0d3ad3d5e92043232b293be2a305d3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    640c1bd8d359ad34817f5afec0872985e87b49ec
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    46e50367338702abe3df661df7795bdada40fef7
  - Linux < 6.6.158
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:54:46.243Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98908'
references:
  - url: 'https://git.kernel.org/stable/c/a7625d408f7f0535c2b0f05d53231d6496acd48b'
  - url: 'https://git.kernel.org/stable/c/a46ea3f7ee0d3ad3d5e92043232b293be2a305d3'
  - url: 'https://git.kernel.org/stable/c/640c1bd8d359ad34817f5afec0872985e87b49ec'
  - url: 'https://git.kernel.org/stable/c/46e50367338702abe3df661df7795bdada40fef7'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.572Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: microchip: sparx5: clean up PSFP resources on flower setup failure

sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and
stream filter resources before adding VCAP actions. If a later step
fails, the resources allocated earlier in the function are not unwound.

Add error paths to release the stream filter, flow meter and stream gate
when setup fails after they have been acquired.

Also make sparx5_psfp_fm_add() return the acquired flow-meter id before
the existing-flow-meter early return. When an existing flow meter is
reused, sparx5_psfp_fm_get() increments its pool reference count, but the
caller previously kept psfp_fmid as 0. If a later setup step failed, the
error path could try to delete flow-meter id 0 instead of the reused flow
meter, leaving the incremented reference behind.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a7625d408f7f0535c2b0f05d53231d6496acd48b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a46ea3f7ee0d3ad3d5e92043232b293be2a305d3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 640c1bd8d359ad34817f5afec0872985e87b49ec`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 46e50367338702abe3df661df7795bdada40fef7`
- `Linux < 6.6.158`
- `Linux < 6.12.111`
- `Linux < 6.18.53`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.