Executive brief
A race condition in the Linux kernel's mlx5e network driver can cause a NULL pointer dereference when querying network device statistics on weak memory-ordering architectures like ARM. This defect affects systems running the mlx5 driver during network interface initialization, potentially causing kernel crashes and service interruptions.
Technical details
The vulnerability is a publication race in mlx5e_channel_stats_alloc() where a new channel_stats entry is written and then stats_nch is incremented as a publication token, but without memory barriers. On weakly-ordered architectures (ARM, PowerPC, RISC-V), concurrent readers can observe an incremented stats_nch while the corresponding channel_stats[N-1] entry is still NULL, leading to NULL pointer dereference. The issue occurs during channel allocation on one CPU while statistics queries happen on another. The fix introduces smp_store_release() and smp_load_acquire() helpers to establish a synchronization contract ensuring channel_stats entries are visible before stats_nch is incremented. This is a kernel bug affecting the mlx5_core driver on weakly-ordered architectures.
Affected products
- Linux Linux kernel multiple versions affected (fixed in current mainline)
Timeline
- 2026-08-15: disclosed
- patched: Fix applied via mlx5e_stats_nch_write/read helpers