CVE-2026-90128

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

AZL-102287 CVE-2026-90128 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-93109 RDMA/mlx5: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

EUVD-2026-82217

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90435

CVE-2026-90435 is an integer overflow vulnerability in the Linux kernel's RDMA/mlx5 subsystem. The function set_user_buf_size() left-shifts user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers ; a sufficiently large rq.wqe_cnt triggers signed integer overflow (undefined behavior), ...

CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

EUVD-2026-82096

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90416

This stack out-of-bounds read affects the RDMA/mlx5 driver's cc_params debugfs interface in the Linux kernel . The root cause is a format-string mismatch: get_param() reads a congestion control parameter as a u32 but formats it with the signed "%d" specifier into an 11-byte stack buffer . When a ...

CVE-2026-90416 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

EUVD-2026-82077

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90416 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90128

CVE-2026-90128 is a bug in the Linux kernel's vdpa/mlx5 driver, specifically in the add_direct_chain() function. Newly allocated direct MR entries are added to a local list tmp, which is spliced into mr->head only on success. However, on the error path, the cleanup loop incorrectly iterated ov...

CVE-2026-90128 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90128 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

EUVD-2026-81721

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in adddirectchain error path In adddirectchain, newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr-head only on success. On the error path, the cleanup...

CVE-2026-90086

CVE-2026-90086 affects the Linux kernel AF_XDP (xsk) zero-copy TX path . The root cause is that the zero-copy path reads TX metadata whenever the UMEM has metadata space, even when the descriptor does not set the XDP_TX_METADATA flag. The fix passes descriptor options through the metadata helpers...

EUVD-2026-81947

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

PT-2026-94905

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA mlx5 component where the devx free subscription function can remain queued after the last DevX event file drops its module reference or an auxiliary driver...

CVE-2026-93109: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...