CVE-2026-74395

Received Received - Intake

RDMA/mlx5 devx subscribe-event NULL dereference fix

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdget() then fails, the unwind path dereferences event_sub->ev_file in uverbs_uobject_put() and calls subscribe_event_xa_dealloc() with an unset xa_key_level1. subscribe_event_xa_alloc() creates the XA entry exactly once for a given key_level1, on the first occurrence of that key. The unwind path must therefore call subscribe_event_xa_dealloc() exactly once for it as well. Enforce that by adding devx_key_in_sub_list() and calling subscribe_event_xa_dealloc() only when the last matching pending entry is being cleaned up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74395

EUVD

EUVD-2026-59542

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL dereference issue in the RDMA/mlx5 driver. The problem occurs when the MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() function links an event_sub into a sub_list before initializing critical fields. If an error occurs during eventfd_ctx_fdget(), the unwind path incorrectly dereferences event_sub->ev_file, leading to a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/mlx5 driver and requires kernel-level inspection. Detection involves checking kernel logs for errors related to mlx5 or devx operations. Commands like dmesg | grep mlx5 or journalctl -k | grep mlx5 may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could cause system crashes or instability in systems using the affected Linux kernel components, particularly those with RDMA/mlx5 functionality. It may lead to denial-of-service conditions if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific Linux kernel RDMA driver issue. Compliance impacts would depend on system configuration and usage rather than this technical flaw.

Mitigation Strategies

Immediately update the Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security advisories for the patched kernel version. Reboot the system after applying the update to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-74395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70