CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

EUVD-2026-59105

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

CVE-2026-72345: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5lagcreatesinglefdb starts from i, so the failed index itself is rolled back. That can operate on uninitialized stat...

PT-2026-72832

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA mlx5 component where the mlx5r umr update xlt function allocates and DMA maps an XLT buffer using mlx5r umr create xlt. When mlx5 odp populate xlt fails, the...

PT-2026-72533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the single-FDB error rollback mechanism within the LAG component. When a failure occurs at index i, the reverse cleanup loop in the mlx5 lag create single f...

PT-2026-72733

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/mlx5 component where the set rq size function computes the Receive Queue RQ Work Queue Element WQE size using a bitwise shift operation based on the...

PT-2026-72732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/mlx5 component where the software-provided UAR User Access Region index was being released instead of the index provided by the hardware. The fix ensures that...

CVE-2026-74296: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-74297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

PT-2026-72195

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the net/mlx5 component when workloads repeatedly allocate and release mkeys that carry TPH steering-tag hints, such as churning RDMA MRs. The issue arises because...

Linux Distros Unpatched Vulnerability : CVE-2026-74296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Release the HWprovided UAR index rather than the SW one Free the UAR index returned by the hardware. CVE-2026-74296 Note that Nessus relies on the...

CVE-2026-72032: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If mlx5hwsmatcherresizesettarget fails, the replacement matcher is not...

CVE-2026-72006: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

PT-2026-72831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference exists in the RDMA/mlx5 component. The function MLX5 IB METHOD DEVX SUBSCRIBE EVENT links event sub into sub list before initializing fields required by the shared err...

CVE-2026-74397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

PT-2026-72833

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IB/mlx5 component where the mlx5 ib alloc transport domain function allocates a transport domain TD but may fail during the execution of mlx5 ib enable lb. When th...

Linux Distros Unpatched Vulnerability : CVE-2026-74397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in...

PT-2026-72529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A publication race exists in the net/mlx5e module. The function mlx5e channel stats alloc updates the priv-channel stats array and increments the priv-stats nch variable without using...

Linux Distros Unpatched Vulnerability : CVE-2026-72341

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix publication race for priv-channelstats mlx5echannelstatsalloc publishes a new entry to priv-channelstats and then increments priv-statsnch as a...