Executive brief
The Linux kernel's RDMA/mlx5 driver handles remote direct memory access event subscriptions. A flaw in error handling during event subscription initialization can cause a NULL pointer dereference when event file descriptor setup fails, potentially crashing the system or causing memory corruption.
Technical details
This is a null pointer dereference vulnerability in the RDMA/mlx5 driver's devx subscribe-event handler (MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT). The vulnerability occurs when an event subscription structure is linked into a list before all its fields are initialized. If eventfd_ctx_fdget() fails during initialization, the error unwinding path dereferences uninitialized fields (event_sub->ev_file) and makes incorrect calls to subscribe_event_xa_dealloc() with unset xa_key_level1 values. Since XA entries are created exactly once per key but may be deallocated multiple times on error, this causes resource leaks or invalid memory access. The fix adds devx_key_in_sub_list() to ensure deallocation happens only once per key during cleanup.
Affected products
- Linux Linux kernel Multiple kernel versions (fix addresses versions prior to introduction of this fix)
Timeline
- 2026-08-15: disclosed: CVE published
- 2026-05-18: patched: Upstream fix committed (43f8f7946814c8e5f464518246fdbc69b6e32326)
- 2026-07-24: patched: Stable kernel backport (1025dc2f7ba29b04b8687790fa91f9cd1a53141e)