CVE-2026-68139
Received Received - Intake

Kernel NULL Pointer Dereference in Mellanox mlx5_core

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport 0000:10:01.1: DPC: containment event pcieport 0000:10:01.1: PCIe Bus Error: severity=Uncorrected (Fatal) pcieport 0000:10:01.1: [ 5] SDES (First) mlx5 recovered the PCI functions and resumed 0000:11:00.1. During that resume, RDMA multiport binding replayed MLX5_DRIVER_EVENT_AFFILIATION_DONE and mlx5e sent MPV_DEVCOM_MASTER_UP. The host then panicked with: BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] RDI: 0000000000000000 Call trace included: mlx5_devcom_comp_set_ready mlx5e_devcom_event_mpv mlx5_devcom_send_event mlx5_ib_bind_slave_port mlx5r_mp_probe mlx5_pci_resume MPV devcom registration publishes mlx5e private data to the component peer list before mlx5e_devcom_init_mpv() stores the returned component device in priv->devcom. A concurrent master-up event can therefore reach a peer whose private data is visible but whose priv->devcom backpointer is still NULL. MPV_DEVCOM_MASTER_UP already carries the sender/master mlx5e private data as event_data. The ready bit is stored on the shared devcom component, not on an individual peer. Use the sender devcom when marking the MPV component ready. This preserves the readiness transition while avoiding a NULL dereference of the peer devcom pointer during affiliation replay after PCI error recovery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68139
EUVD
EUVD-2026-55520

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mlx mlx5e *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a kernel NULL pointer dereference flaw in the Linux kernel's mlx5e driver for Mellanox ConnectX network adapters. It occurs during PCIe DPC recovery when the driver replays multiport affiliation events. A race condition happens because the MPV component's readiness is marked using a peer's devcom pointer before that pointer is properly initialized, leading to a crash when the pointer is NULL.

Impact Analysis

If exploited, this vulnerability can cause a system crash (kernel panic) during PCIe error recovery on systems using Mellanox ConnectX adapters. This leads to denial of service, potential data loss, and requires a system reboot to recover. Systems without these adapters are unaffected.

Compliance Impact

This vulnerability primarily impacts system availability and integrity. For GDPR, it could affect data processing continuity. For HIPAA, it may disrupt critical healthcare systems. Compliance may require timely patching to maintain security controls and data protection standards.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves the net/mlx5e vulnerability. Monitor PCIe DPC recovery events and mlx5 driver logs for NULL pointer dereference errors. Ensure mlx5e_devcom_init_mpv() completes before processing MPV_DEVCOM_MASTER_UP events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart