CVE-2026-97962
Received Received - Intake

Race Condition in Linux Kernel MLX5 Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev (un)load path, which is not serialized by the devlink instance lock. Destroying the reporter from there triggers a devl_assert_locked() splat on driver unbind: WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758 Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ... CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ... RIP: 0010:devl_assert_locked+0x54/0x70 Call Trace: <TASK> devl_health_reporter_destroy+0x3a/0x1b0 mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core] mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core] ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core] ? kernfs_remove_by_name_ns+0xc3/0xf0 device_release_driver_internal+0x3b2/0x560 unbind_store+0xce/0xf0 Move the reporter's lifecycle to the eswitch devlink port (un)register paths, which are already serialized by the devlink instance lock, and store the handle on mlx5_devlink_port. Use the port's mlx5_vport as the reporter priv since the diagnose callback only needs a device handle and a vport number, and mlx5_vport carries both and is initialized before any representor driver probes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97962
EUVD
EUVD-2026-86816

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the representor vnic devlink health reporter. The reporter is created and destroyed along the representor netdev load/unload path without proper serialization by the devlink instance lock. This causes a devl_assert_locked() warning during driver unbind, indicating the lock was not held when it should have been.

Detection Guidance

This vulnerability is specific to the Linux kernel's mlx5e driver and may not have direct detection commands. However, you can check for kernel warnings or splats related to devlink health reporters or mlx5_core modules using dmesg or journalctl. Look for messages about devl_assert_locked or mlx5e_vport_rep_unload.

Impact Analysis

This vulnerability may cause system instability or warnings during driver unbind operations, particularly when unloading the mlx5_core module. It does not appear to directly impact security but could lead to operational issues in systems using Mellanox network hardware.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. The issue is resolved by moving the reporter's lifecycle to the eswitch devlink port paths, which requires a kernel update. Check your distribution's security advisories for the patched kernel version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart