Skip to content
Heist/ feed
UnratedFix available

RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdget() then fails, the unwind path dereferences event_sub->ev_file in uverbs_uobject_put() and calls subscribe_event_xa_dealloc() with an unset xa_key_level1. subscribe_event_xa_alloc() creates the XA entry exactly once for a given key_level1, on the first occurrence of that key. The unwind path must therefore call subscribe_event_xa_dealloc() exactly once for it as well. Enforce that by adding devx_key_in_sub_list() and calling subscribe_event_xa_dealloc() only when the last matching pending entry is being cleaned up.

Announced Source revision 1
Original source ↗

CVE-2026-74395

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-74395

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.10.261

Source reference: /affected/1/ranges

5.15.212

Source reference: /affected/1/ranges

6.1.178

Source reference: /affected/1/ranges

6.6.145

Source reference: /affected/1/ranges

6.12.97

Source reference: /affected/1/ranges

6.18.40

Source reference: /affected/1/ranges

7.1.5

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "7597385371425febdaa8c6a1da3625d4ffff16f5"
          },
          {
            "fixed": "6e15b770461eeaa0ff73934922cb670a6a9db04e"
          },
          {
            "fixed": "9be9aca28424228586fe9211c373ebdb826ebb6c"
          },
          {
            "fixed": "f345e744b6b087188cde2377da5cbe9713b61353"
          },
          {
            "fixed": "1025dc2f7ba29b04b8687790fa91f9cd1a53141e"
          },
          {
            "fixed": "7921821fc2b19c01588311f6e7468ae5b68b1f61"
          },
          {
            "fixed": "5100febf8e9d6c8c5ba8dc6534c6a5e3376e5989"
          },
          {
            "fixed": "78b9589fda266c71f0f9d0c858d4fa7381a890a5"
          },
          {
            "fixed": "43f8f7946814c8e5f464518246fdbc69b6e32326"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74395.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.3.0"
          },
          {
            "fixed": "5.10.261"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.11.0"
          },
          {
            "fixed": "5.15.212"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.16.0"
          },
          {
            "fixed": "6.1.178"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.2.0"
          },
          {
            "fixed": "6.6.145"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.7.0"
          },
          {
            "fixed": "6.12.97"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.13.0"
          },
          {
            "fixed": "6.18.40"
          }
        ]
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.19.0"
          },
          {
            "fixed": "7.1.5"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74395.json"
    }
  }
]
Related CVEs
CVE-2026-74395

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50714 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement