PT-2026-72530
CVE-2026-72342
·
Published
2026-06-30
·
Updated
2026-10-13
Description by
CVSS 3.1
8.4
HighMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A registration race condition exists in the
net/mlx5e module. The function mlx5e hv vhca stats create() uses mlx5 hv vhca agent create() to register a stats agent. This helper publishes the agent and schedules an asynchronous control invalidation before returning. If the asynchronous control path executes before the delayed work and priv->stats agent.agent are initialized, it can lead to several issues:- Invoking a NULL function pointer when the timer expires.
- Corrupting the hlist by re-initializing the timer while it is already enqueued.
- Dereferencing a NULL pointer in
mlx5 hv vhca agent write()whenmlx5e hv vhca stats work()reads an uninitializedsagent->agent.
The issue involves the
mlx5e hv vhca stats control() function and the priv->stats agent.work and priv->stats agent.agent variables.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾