CVE-2026-68139

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the Linux kernel during PCIe DPC (Downstream Port Containment) recovery. When the mlx5 driver reloads functions and replays multiport affiliation events, the MPV devcom registration publishes mlx5e private data to the component peer list before the mlx5e devcom init mpv() function stores the returned component device in priv->devcom. Consequently, a concurrent master-up event can reach a peer where the private data is visible but the priv->devcom backpointer remains NULL, leading to a kernel panic. This issue is triggered during the execution of the mlx5 devcom comp set ready() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.