Executive brief
A race condition vulnerability was identified in the Linux kernel's NVIDIA Mellanox (mlx5) driver. This issue occurs because certain internal status flags were stored in a way that allowed multiple system processes to attempt to update them simultaneously, potentially leading to inconsistent device states. While primarily a stability and correctness issue, it could affect the reliability of virtualized network functions and hardware migration tasks.
Technical details
The vulnerability stems from the use of non-atomic bitfield operations (read-modify-write pattern) in the mlx5_vhca_page_tracker and mlx5vf_pci_core_device structures. Specifically, flags modified at runtime—such as mdev_detach, log_active, deferred_reset, is_err, and object_changed—were packed into the same storage units as flags modified only during probe/release. An attacker or concurrent system events (e.g., VF attach/detach, PCI AER reset, or dirty-log polling) could trigger racy updates. The fix involves moving runtime-modified flags into dedicated storage units to ensure thread safety. The issue was introduced in version 6.4 and has been patched in various stable branches including 6.6.y, 6.9.y, and the mainline kernel.
Affected products
- Linux Linux Kernel 6.4 through 6.9.x
Timeline
- 2026-06-15: disclosed: Initial patch submission to kernel mailing list
- 2026-07-24: patched: Patch committed to stable trees
- 2026-07-25: advisory: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb
- https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af
- https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287
- https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59
- https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be
- https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1