CVE-2026-64122 (GCVE-0-2026-64122)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown. The netdev_err() call already used priv->netdev for this reason; make the trylock/unlock and health_channel_eq_recover calls consistent. This fixes the following KASAN splat: BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277 Call Trace: mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] devlink_health_reporter_recover+0xa2/0x150 devlink_health_report+0x254/0x7c0 mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core] mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core] process_one_work+0x677/0xf20 worker_thread+0x51f/0xd90 kthread+0x3a5/0x810 ret_from_fork+0x208/0x400 ret_from_fork_asm+0x1a/0x30
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4329514c61abefe4961541b128c549b017bab5ad , < 1604a2d68414aa4cc34faac0b7faa9c14455e8d3 (git)
Affected: 83ac0304a2d77519dae1e54c9713cbe1aedf19c9 , < 152295aa7dc2c5e046606f7dadc84fce41136446 (git)
Affected: 83ac0304a2d77519dae1e54c9713cbe1aedf19c9 , < 7d260c5d2d89eb2c8c528d54b576b3aae3e20231 (git)
Affected: 63f9d5fb4d8040077df801ca3270e2f02d55e0d9 (git)
Affected: 6.18.14 , < 6.18.34 (semver)
Affected: 6.19.4 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1604a2d68414aa4cc34faac0b7faa9c14455e8d3",
              "status": "affected",
              "version": "4329514c61abefe4961541b128c549b017bab5ad",
              "versionType": "git"
            },
            {
              "lessThan": "152295aa7dc2c5e046606f7dadc84fce41136446",
              "status": "affected",
              "version": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9",
              "versionType": "git"
            },
            {
              "lessThan": "7d260c5d2d89eb2c8c528d54b576b3aae3e20231",
              "status": "affected",
              "version": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63f9d5fb4d8040077df801ca3270e2f02d55e0d9",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.34",
              "status": "affected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.18.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover\n\nmlx5e_tx_reporter_timeout_recover() accesses sq-\u003enetdev after\nmlx5e_safe_reopen_channels() has torn down and freed the channel (and\nits embedded SQs). Replace the three sq-\u003enetdev references with\npriv-\u003enetdev which is safe because priv outlives channel teardown.\n\nThe netdev_err() call already used priv-\u003enetdev for this reason; make\nthe trylock/unlock and health_channel_eq_recover calls consistent.\n\nThis fixes the following KASAN splat:\n\n  BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]\n  Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277\n\n  Call Trace:\n   mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]\n   devlink_health_reporter_recover+0xa2/0x150\n   devlink_health_report+0x254/0x7c0\n   mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core]\n   mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core]\n   process_one_work+0x677/0xf20\n   worker_thread+0x51f/0xd90\n   kthread+0x3a5/0x810\n   ret_from_fork+0x208/0x400\n   ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from the mlx5e netdev TX-timeout watchdog recovery path on Mellanox ConnectX NICs deployed on internet-facing cloud/datacenter servers; remote peers generate outbound traffic that can stall TX queues and fire `ndo_tx_timeout`, leading to `mlx5e_tx_reporter_timeout_recover()` without any local syscall.\nAC:L - Once a TX timeout occurs, recovery is deterministic: `mlx5e_health_channel_eq_recover()` typically fails when no EQEs are pending, `mlx5e_safe_reopen_channels()` frees the embedded SQ, and the stale `sq-\u003enetdev` dereference in `netdev_unlock()` always follows on that fallback path rather than requiring a race the attacker cannot influence.\nPR:N - No capability checks or authentication gates exist on the TX-timeout \u2192 devlink health auto-recover call chain; an unauthenticated remote attacker who can send traffic to a host mlx5 interface can induce the watchdog/recovery sequence without root, CAP_NET_ADMIN, or user-namespace privileges.\nUI:N - Exploitation requires no victim user action such as mounting a filesystem or opening a file; it is triggered automatically by the kernel netdev watchdog and workqueue recovery once TX queues stall.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same host kernel security authority; this is not a VM-guest-to-host escape, IOMMU bypass, or other cross-boundary scenario.\nC:H - The KASAN splat confirms an 8-byte use-after-free read of `sq-\u003enetdev` from freed channel/SQ memory; UAF on this structure pointer can be leveraged for arbitrary kernel memory disclosure via heap reuse and controlled reads through the corrupted `net_device` reference.\nI:H - The UAF supplies a controlled `struct net_device *` to `netdev_unlock()`, which performs `mutex_unlock()` on attacker-influenced freed memory, enabling heap spraying and memory corruption primitives that can be developed into arbitrary kernel write or code execution.\nA:H - Use-after-free in kernel TX recovery provably causes KASAN faults and can panic or oops the host during `netdev_unlock()` on freed SQ memory, producing complete loss of kernel availability on affected mlx5 systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:28.664Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1604a2d68414aa4cc34faac0b7faa9c14455e8d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/152295aa7dc2c5e046606f7dadc84fce41136446"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d260c5d2d89eb2c8c528d54b576b3aae3e20231"
        }
      ],
      "title": "net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64122",
    "datePublished": "2026-07-19T15:40:20.446Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-08-05T12:39:28.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64122",
      "date": "2026-09-21",
      "epss": "0.00461",
      "percentile": "0.39123"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1604a2d68414aa4cc34faac0b7faa9c14455e8d3",
                    "status": "affected",
                    "version": "4329514c61abefe4961541b128c549b017bab5ad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "152295aa7dc2c5e046606f7dadc84fce41136446",
                    "status": "affected",
                    "version": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d260c5d2d89eb2c8c528d54b576b3aae3e20231",
                    "status": "affected",
                    "version": "83ac0304a2d77519dae1e54c9713cbe1aedf19c9",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "63f9d5fb4d8040077df801ca3270e2f02d55e0d9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.34",
                    "status": "affected",
                    "version": "6.18.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE4C1641-E263-422B-BEAD-A3B6E40DB5EC",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.18.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "08225BCD-840E-490B-A961-B7200E94D5AF",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover\n\nmlx5e_tx_reporter_timeout_recover() accesses sq-\u003enetdev after\nmlx5e_safe_reopen_channels() has torn down and freed the channel (and\nits embedded SQs). Replace the three sq-\u003enetdev references with\npriv-\u003enetdev which is safe because priv outlives channel teardown.\n\nThe netdev_err() call already used priv-\u003enetdev for this reason; make\nthe trylock/unlock and health_channel_eq_recover calls consistent.\n\nThis fixes the following KASAN splat:\n\n  BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]\n  Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277\n\n  Call Trace:\n   mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]\n   devlink_health_reporter_recover+0xa2/0x150\n   devlink_health_report+0x254/0x7c0\n   mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core]\n   mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core]\n   process_one_work+0x677/0xf20\n   worker_thread+0x51f/0xd90\n   kthread+0x3a5/0x810\n   ret_from_fork+0x208/0x400\n   ret_from_fork_asm+0x1a/0x30"
          }
        ],
        "id": "CVE-2026-64122",
        "lastModified": "2026-08-13T15:11:37.460",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:53.790",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/152295aa7dc2c5e046606f7dadc84fce41136446"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1604a2d68414aa4cc34faac0b7faa9c14455e8d3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d260c5d2d89eb2c8c528d54b576b3aae3e20231"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T16:47:26+00:00",
      "cve": "CVE-2026-64122",
      "id": "CVE-2026-64122",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "261",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64122.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-07-21T12:59:18Z",
      "cve": "CVE-2026-64122",
      "id": "CVE-2026-64122",
      "initial_release_date": "2026-07-21T12:59:18Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64122",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64122.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.