CVE-2026-68139 - Vulnerability Details

- net/mlx5e: Use sender devcom for MPV master-up

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Use sender devcom for MPV master-up

After PCIe DPC recovery, mlx5 reloads the affected functions and
replays multiport affiliation events. In the reported failure, the
first relevant device error was:

pcieport 0000:10:01.1: DPC: containment event
pcieport 0000:10:01.1: PCIe Bus Error: severity=Uncorrected (Fatal)
pcieport 0000:10:01.1: [ 5] SDES (First)

mlx5 recovered the PCI functions and resumed 0000:11:00.1. During
that resume, RDMA multiport binding replayed
MLX5_DRIVER_EVENT_AFFILIATION_DONE and mlx5e sent
MPV_DEVCOM_MASTER_UP. The host then panicked with:

BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core]
RDI: 0000000000000000

Call trace included:

mlx5_devcom_comp_set_ready
mlx5e_devcom_event_mpv
mlx5_devcom_send_event
mlx5_ib_bind_slave_port
mlx5r_mp_probe
mlx5_pci_resume

MPV devcom registration publishes mlx5e private data to the component
peer list before mlx5e_devcom_init_mpv() stores the returned component
device in priv->devcom. A concurrent master-up event can therefore
reach a peer whose private data is visible but whose priv->devcom
backpointer is still NULL.

MPV_DEVCOM_MASTER_UP already carries the sender/master mlx5e private
data as event_data. The ready bit is stored on the shared devcom
component, not on an individual peer. Use the sender devcom when
marking the MPV component ready.

This preserves the readiness transition while avoiding a NULL
dereference of the peer devcom pointer during affiliation replay after
PCI error recovery.

Published: 2026-08-10

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel network driver for Mellanox Ethernet adapters contains a flaw that can lead to a kernel panic when an MPV devcom master‑up event is replayed after a PCIe DPC recovery. The code incorrectly uses a sender devcom pointer that may not yet be initialized, resulting in a NULL pointer dereference. This flaw is a classic NULL pointer dereference (CWE‑476) and can crash the system, causing a denial of service.

Affected Systems

Any Linux kernel build that includes the mlx5e driver and supports MPV multiport functionality is affected – this includes kernels shipped with Mellanox ConnectX adapters. No specific kernel versions are listed, so the issue is presumed to exist in all affected releases until the commit is back‑ported. Users should verify if their kernel contains the fix described in the linked commits.

Risk and Exploitability

The fault is triggered by a PCIe DPC containment event, which may occur spontaneously or due to external hardware errors. Attacking would require inducing such an event or an existing error. The CVSS score is 5.5, indicating moderate severity, and the EPSS score is less than 1 %, indicating a very low probability of exploitation. The flaw is not listed in CISA KEV, and no exploit is publicly known. Nonetheless, a kernel panic leads to immediate service disruption, so the risk is significant for affected systems that cannot update their kernel promptly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bf11485f8419f90ffaa3804fd01d8468fcc56e23`	affected	< c698b2735613f1f35c55688bd2252f75f31c49ad
`bf11485f8419f90ffaa3804fd01d8468fcc56e23`	affected	< 40f9a124ebbe0d60fe165fb3f87515c35b2d72f5
`bf11485f8419f90ffaa3804fd01d8468fcc56e23`	affected	< a60c81f168c9fe4f5d84302d1e32b717f5a8a933
`bf11485f8419f90ffaa3804fd01d8468fcc56e23`	affected	< e32649b4bad90a6216d8e93cd7dd050af8ac9740

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bf11485f8419f90ffaa3804fd01d8468fcc56e23,c698b2735613f1f35c55688bd2252f75f31c49ad)`	affected	code_commit	—
`[bf11485f8419f90ffaa3804fd01d8468fcc56e23,40f9a124ebbe0d60fe165fb3f87515c35b2d72f5)`	affected	code_commit	—
`[bf11485f8419f90ffaa3804fd01d8468fcc56e23,a60c81f168c9fe4f5d84302d1e32b717f5a8a933)`	affected	code_commit	—
`[bf11485f8419f90ffaa3804fd01d8468fcc56e23,e32649b4bad90a6216d8e93cd7dd050af8ac9740)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the commit restoring proper MPV devcom readiness handling for the mlx5e driver.
If an upgrade is not feasible, backport the patch from the commits cited in the references to your current kernel and rebuild the mlx5e and mlx5_core modules.
If neither patching nor upgrading can be performed immediately, monitor kernel logs for PCIe DPC containment events and consider disabling MPV affiliation or limiting multi‑port functionality on Mellanox adapters to reduce the chance of a replay after recovery.

Generated by OpenCVE AI on August 13, 2026 at 07:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/40f9a124ebbe0d60fe165fb3f87515c35b2d72f5
https://git.kernel.org/stable/c/a60c81f168c9fe4f5d84302d1e32b717f5a8a933
https://git.kernel.org/stable/c/c698b2735613f1f35c55688bd2252f75f31c49ad
https://git.kernel.org/stable/c/e32649b4bad90a6216d8e93cd7dd050af8ac9740
https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68139-276e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68139
https://www.cve.org/CVERecord?id=CVE-2026-68139

History

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68139-276e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68139 https://www.cve.org/CVERecord?id=CVE-2026-68139
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport 0000:10:01.1: DPC: containment event pcieport 0000:10:01.1: PCIe Bus Error: severity=Uncorrected (Fatal) pcieport 0000:10:01.1: [ 5] SDES (First) mlx5 recovered the PCI functions and resumed 0000:11:00.1. During that resume, RDMA multiport binding replayed MLX5_DRIVER_EVENT_AFFILIATION_DONE and mlx5e sent MPV_DEVCOM_MASTER_UP. The host then panicked with: BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] RDI: 0000000000000000 Call trace included: mlx5_devcom_comp_set_ready mlx5e_devcom_event_mpv mlx5_devcom_send_event mlx5_ib_bind_slave_port mlx5r_mp_probe mlx5_pci_resume MPV devcom registration publishes mlx5e private data to the component peer list before mlx5e_devcom_init_mpv() stores the returned component device in priv->devcom. A concurrent master-up event can therefore reach a peer whose private data is visible but whose priv->devcom backpointer is still NULL. MPV_DEVCOM_MASTER_UP already carries the sender/master mlx5e private data as event_data. The ready bit is stored on the shared devcom component, not on an individual peer. Use the sender devcom when marking the MPV component ready. This preserves the readiness transition while avoiding a NULL dereference of the peer devcom pointer during affiliation replay after PCI error recovery.
Title		net/mlx5e: Use sender devcom for MPV master-up
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/40f9a124ebbe0d60fe165fb3f87515c35b2d72f5 https://git.kernel.org/stable/c/a60c81f168c9fe4f5d84302d1e32b717f5a8a933 https://git.kernel.org/stable/c/c698b2735613f1f35c55688bd2252f75f31c49ad https://git.kernel.org/stable/c/e32649b4bad90a6216d8e93cd7dd050af8ac9740

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:59:02.768Z

Updated: 2026-08-17T04:59:32.634Z

Reserved: 2026-07-30T09:28:09.370Z

Link: CVE-2026-68139

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:59.523

Modified: 2026-08-17T05:18:13.847

Link: CVE-2026-68139

Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68139 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object