Executive brief
A bug in the Linux kernel's Mellanox vDPA (virtual Data Path Acceleration) driver causes incorrect cleanup during memory registration failures. When allocating new memory regions fails, the driver attempts to free allocated entries from the wrong list, potentially causing memory leaks or system instability in virtualization environments using Mellanox hardware.
Technical details
This is a logic error in the error handling path of the add_direct_chain() function in drivers/vdpa/mlx5/core/mr.c. The function allocates direct memory region (MR) entries and temporarily stores them in a local list called 'tmp', which is only spliced into the persistent mr->head list on success. However, in the error path (err_alloc label), the cleanup code incorrectly iterates over mr->head instead of tmp, causing it to attempt cleanup on the wrong list and leaving allocated memory unfreed. The fix changes a single line to iterate over 'tmp' instead, ensuring proper cleanup of only the newly allocated entries that were not yet committed. This is a code-level defect with no known exploitation; the impact is resource leakage during failure conditions.
Affected products
- Linux Linux kernel 5.0 and later
Timeline
- 2026-09-17: disclosed: CVE-2026-90128 published
- 2026-08-19: patched: Upstream fix merged (commit 23ae56d9e74c122f95cae71ae3b9fc259fb88446)
- 2026-07-01: other: Original fix submitted by Li RongQing