CVE-2026-72341 (GCVE-0-2026-72341)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:12
VLAI
Title
net/mlx5e: Fix publication race for priv->channel_stats[]
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store carries any memory barrier: priv->channel_stats[ix] = kvzalloc_node(...); if (!priv->channel_stats[ix]) return -ENOMEM; priv->stats_nch++; Concurrent readers compute the loop bound from priv->stats_nch and then dereference priv->channel_stats[i] using plain accesses, e.g. for (i = 0; i < priv->stats_nch; i++) { struct mlx5e_channel_stats *cs = priv->channel_stats[i]; ... cs->rq.packets ... } On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop. This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc() on another CPU: Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] dev_get_stats+0x50/0xc0 ovs_vport_get_stats+0x38/0xac [openvswitch] ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch] ovs_vport_cmd_get+0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit+0xd0/0x160 genl_rcv_msg+0xec/0x1f0 netlink_rcv_skb+0x64/0x130 genl_rcv+0x40/0x60 netlink_unicast+0x2fc/0x370 netlink_sendmsg+0x1dc/0x454 ... __arm64_sys_sendmsg+0x2c/0x40 Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract: stats_nch == N => channel_stats[0..N-1] are visible and non-NULL. Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fa691d0c9c0812b9045f3a9420862e47b3b92518 , < 5c7e3755abf663f033de24f917b77685e9543045 (git)
Affected: fa691d0c9c0812b9045f3a9420862e47b3b92518 , < 815515ec68f527ca755cb1e2c1ff9148f6b3ea56 (git)
Affected: fa691d0c9c0812b9045f3a9420862e47b3b92518 , < 5a799714e8ca0bce9ea40694f49914cf1adbbaa9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c7e3755abf663f033de24f917b77685e9543045",
              "status": "affected",
              "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
              "versionType": "git"
            },
            {
              "lessThan": "815515ec68f527ca755cb1e2c1ff9148f6b3ea56",
              "status": "affected",
              "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
              "versionType": "git"
            },
            {
              "lessThan": "5a799714e8ca0bce9ea40694f49914cf1adbbaa9",
              "status": "affected",
              "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix publication race for priv-\u003echannel_stats[]\n\nmlx5e_channel_stats_alloc() publishes a new entry to\npriv-\u003echannel_stats[] and then increments priv-\u003estats_nch as a\npublication token, but neither store carries any memory barrier:\n\n\tpriv-\u003echannel_stats[ix] = kvzalloc_node(...);\n\tif (!priv-\u003echannel_stats[ix])\n\t\treturn -ENOMEM;\n\tpriv-\u003estats_nch++;\n\nConcurrent readers compute the loop bound from priv-\u003estats_nch and\nthen dereference priv-\u003echannel_stats[i] using plain accesses, e.g.\n\n\tfor (i = 0; i \u003c priv-\u003estats_nch; i++) {\n\t\tstruct mlx5e_channel_stats *cs = priv-\u003echannel_stats[i];\n\t\t... cs-\u003erq.packets ...\n\t}\n\nOn weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to\nchannel_stats[ix] and stats_nch may become visible to other CPUs out\nof program order. A reader can observe stats_nch == N while still\nseeing channel_stats[N-1] == NULL, leading to a NULL pointer\ndereference in the channel_stats loop.\n\nThis has been observed in production on BlueField-3 DPUs (arm64),\nwhere ovs-vswitchd queries netdev statistics over netlink during NIC\nbringup, racing mlx5e_open_channel() -\u003e mlx5e_channel_stats_alloc()\non another CPU:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0x840\n  Hardware name: BlueField-3 DPU\n  pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n  Call trace:\n   mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n   dev_get_stats+0x50/0xc0\n   ovs_vport_get_stats+0x38/0xac [openvswitch]\n   ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]\n   ovs_vport_cmd_get+0xbc/0x10c [openvswitch]\n   genl_family_rcv_msg_doit+0xd0/0x160\n   genl_rcv_msg+0xec/0x1f0\n   netlink_rcv_skb+0x64/0x130\n   genl_rcv+0x40/0x60\n   netlink_unicast+0x2fc/0x370\n   netlink_sendmsg+0x1dc/0x454\n   ...\n   __arm64_sys_sendmsg+0x2c/0x40\n\nAdd mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h\nthat wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.\nThe release/acquire pair establishes the contract:\n\n  stats_nch == N  =\u003e  channel_stats[0..N-1] are visible and non-NULL.\n\nPublish the stats_nch increment via mlx5e_stats_nch_write() in the\nwriter (mlx5e_channel_stats_alloc()), and read stats_nch via\nmlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,\nmlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the\nsw_stats fold and the HV VHCA stats agent."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:12:50.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045"
        },
        {
          "url": "https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9"
        }
      ],
      "title": "net/mlx5e: Fix publication race for priv-\u003echannel_stats[]",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72341",
    "datePublished": "2026-08-15T05:55:47.764Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:12:50.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72341",
      "date": "2026-09-20",
      "epss": "0.00207",
      "percentile": "0.11106"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5c7e3755abf663f033de24f917b77685e9543045",
                    "status": "affected",
                    "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "815515ec68f527ca755cb1e2c1ff9148f6b3ea56",
                    "status": "affected",
                    "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5a799714e8ca0bce9ea40694f49914cf1adbbaa9",
                    "status": "affected",
                    "version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix publication race for priv-\u003echannel_stats[]\n\nmlx5e_channel_stats_alloc() publishes a new entry to\npriv-\u003echannel_stats[] and then increments priv-\u003estats_nch as a\npublication token, but neither store carries any memory barrier:\n\n\tpriv-\u003echannel_stats[ix] = kvzalloc_node(...);\n\tif (!priv-\u003echannel_stats[ix])\n\t\treturn -ENOMEM;\n\tpriv-\u003estats_nch++;\n\nConcurrent readers compute the loop bound from priv-\u003estats_nch and\nthen dereference priv-\u003echannel_stats[i] using plain accesses, e.g.\n\n\tfor (i = 0; i \u003c priv-\u003estats_nch; i++) {\n\t\tstruct mlx5e_channel_stats *cs = priv-\u003echannel_stats[i];\n\t\t... cs-\u003erq.packets ...\n\t}\n\nOn weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to\nchannel_stats[ix] and stats_nch may become visible to other CPUs out\nof program order. A reader can observe stats_nch == N while still\nseeing channel_stats[N-1] == NULL, leading to a NULL pointer\ndereference in the channel_stats loop.\n\nThis has been observed in production on BlueField-3 DPUs (arm64),\nwhere ovs-vswitchd queries netdev statistics over netlink during NIC\nbringup, racing mlx5e_open_channel() -\u003e mlx5e_channel_stats_alloc()\non another CPU:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0x840\n  Hardware name: BlueField-3 DPU\n  pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n  Call trace:\n   mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n   dev_get_stats+0x50/0xc0\n   ovs_vport_get_stats+0x38/0xac [openvswitch]\n   ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]\n   ovs_vport_cmd_get+0xbc/0x10c [openvswitch]\n   genl_family_rcv_msg_doit+0xd0/0x160\n   genl_rcv_msg+0xec/0x1f0\n   netlink_rcv_skb+0x64/0x130\n   genl_rcv+0x40/0x60\n   netlink_unicast+0x2fc/0x370\n   netlink_sendmsg+0x1dc/0x454\n   ...\n   __arm64_sys_sendmsg+0x2c/0x40\n\nAdd mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h\nthat wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.\nThe release/acquire pair establishes the contract:\n\n  stats_nch == N  =\u003e  channel_stats[0..N-1] are visible and non-NULL.\n\nPublish the stats_nch increment via mlx5e_stats_nch_write() in the\nwriter (mlx5e_channel_stats_alloc()), and read stats_nch via\nmlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,\nmlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the\nsw_stats fold and the HV VHCA stats agent."
          }
        ],
        "id": "CVE-2026-72341",
        "lastModified": "2026-08-17T06:18:37.903",
        "metrics": {},
        "published": "2026-08-15T06:22:07.403",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:08:07+00:00",
      "cve": "CVE-2026-72341",
      "id": "CVE-2026-72341",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Fix publication race for priv-\u003echannel_stats[]",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72341.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:28:19Z",
      "cve": "CVE-2026-72341",
      "id": "CVE-2026-72341",
      "initial_release_date": "2026-08-31T16:25:58Z",
      "product_status:known_affected": "534",
      "product_status:known_not_affected": "185",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72341",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72341.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.