Executive brief
The Linux kernel's mlx5 networking driver contains a memory leak in its hardware steering (HWS) component. When a matcher resize operation fails during initialization, a previously allocated matcher object is not properly cleaned up, causing memory to be permanently lost. This could lead to gradual memory exhaustion on systems using Mellanox network adapters with HWS capabilities.
Technical details
The vulnerability is a resource leak (CWE-400) in the mlx5 HWS backward-compatible (bwc) matcher resize logic. The function hws_bwc_matcher_move() allocates a new replacement matcher, then attempts to set it as the resize target via mlx5hws_matcher_resize_set_target(). If that function fails, the newly allocated matcher object is never destroyed and remains orphaned in memory. The fix adds a call to mlx5hws_matcher_destroy(new_matcher) in the error path. No user interaction or elevated privileges are required; the leak occurs during normal driver operation on affected hardware. The vulnerability was discovered through static analysis and confirmed to be present in kernel v6.13-rc1 and later, including v7.1.1.
Affected products
- Linux Linux kernel 6.13-rc1 and later
Timeline
- 2026-06-29: disclosed: Bug discovery and patch submission
- 2026-07-24: patched: Upstream kernel fix merged
- 2026-08-15: advisory: CVE-2026-72032 published