CVE-2026-74395

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL dereference exists in the RDMA/mlx5 component. The function MLX5 IB METHOD DEVX SUBSCRIBE EVENT() links event sub into sub list before initializing fields required by the shared error path. If the function eventfd ctx fdget() fails, the unwind path dereferences event sub->ev file within uverbs uobject put() and invokes subscribe event xa dealloc() with an unset xa key level1 variable. This occurs because subscribe event xa alloc() creates the XA entry only once for a given key level1 on its first occurrence, requiring the unwind path to call subscribe event xa dealloc() exactly once.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.