CVE-2026-64122

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2021-46931

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Wrap the tx reporter dump callback to extract the sq Function mlx5etxreporterdumpsq casts its void argument to struct mlx5etxqsq , but in TX-timeout-recovery flow the argument is actually of type struct mlx5etxtimeoutc...

CVE-2021-46931

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Wrap the tx reporter dump callback to extract the sq Function mlx5etxreporterdumpsq casts its void argument to struct mlx5etxqsq , but in TX-timeout-recovery flow the argument is actually of type struct mlx5etxtimeoutc...

CVE-2021-46931

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Wrap the tx reporter dump callback to extract the sq Function mlx5etxreporterdumpsq casts its void argument to struct mlx5etxqsq , but in TX-timeout-recovery flow the argument is actually of type struct mlx5etxtimeoutc...

CVE-2021-46931

CVE-2021-46931 involves the Linux kernel mlx5e path (net/mlx5e, mlx5_core) where a TX-timeout-recovery flow calls mlx5e_tx_reporter_dump_sq() with a void* that is actually a mlx5e_tx_timeout_ctx*. The mismatch corrupts stack state and can trigger a kernel panic/stack overflow. The fix adds a wrap...

PT-2022-28336

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.90 Description The issue is related to the net/mlx5e component, specifically with wrapping the tx reporter dump callback to extract the sq. The actual impact and attack plausibility have not yet been proven...

PT-2022-28348

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.13 Description The issue is related to the net/mlx5e component, specifically with wrapping the tx reporter dump callback to extract the sq. The actual impact and attack plausibility have not yet been proven...