Executive brief
The Linux kernel contains a race condition in the Hyper-V virtual hardware component (VHCA) statistics agent initialization code. An attacker with local access could trigger this race during driver initialization, potentially causing a kernel null pointer dereference or memory corruption that leads to a denial of service or privilege escalation.
Technical details
A race condition exists in mlx5e_hv_vhca_stats_create() where the stats agent is published and triggers asynchronous invalidation before the delayed_work structure and agent pointer are initialized in the caller. The vulnerable code path publishes the agent via mlx5_hv_vhca_agent_create() and immediately schedules asynchronous callbacks that may operate on uninitialized structures. This can lead to: (1) NULL function pointer dereference when queue_delayed_work() calls add_timer() on an uninitialized timer, (2) heap corruption if INIT_DELAYED_WORK() reinitializes a timer already enqueued in the timer wheel, and (3) NULL pointer dereference when the worker reads sagent->agent. The fix reorders initialization to set up delayed_work before agent creation and adds an out-parameter to mlx5_hv_vhca_agent_create() to safely publish the agent pointer before triggering callbacks.
Affected products
- Linux Linux kernel prior to fix (CVE-2026-72342)
Timeline
- 2026-08-15: disclosed