Executive brief
The Mellanox mlx5 network driver in the Linux kernel contains a bug in its firmware tracer component that can cause the system to crash. When the tracer fails to initialize, the error handling is inconsistent, leading to code that attempts to access invalid memory addresses. This vulnerability can result in kernel panics and system downtime.
Technical details
The vulnerability is a NULL pointer dereference in the mlx5 firmware tracer initialization. The tracer creation function inconsistently returns either NULL or ERR_PTR on failure, but callers and the core dump logic do not properly distinguish between these error states. Specifically, the core dump handler in mlx5_fw_tracer_trigger_core_dump_general() dereferences the tracer pointer without checking for ERR_PTR values, leading to an invalid memory access. The fix standardizes tracer creation to return only NULL on failure, enabling a uniform NULL check. This is a local kernel code path issue affecting systems with mlx5 network adapters running vulnerable kernel versions.
Affected products
- Linux Linux kernel Multiple versions (affected range not specified in advisory)
Timeline
- 2026-08-22: disclosed