CVE-2026-72341 - Vulnerability Details

- net/mlx5e: Fix publication race for priv->channel_stats[]

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix publication race for priv->channel_stats[]

mlx5e_channel_stats_alloc() publishes a new entry to
priv->channel_stats[] and then increments priv->stats_nch as a
publication token, but neither store carries any memory barrier:

priv->channel_stats[ix] = kvzalloc_node(...);
if (!priv->channel_stats[ix])
return -ENOMEM;
priv->stats_nch++;

Concurrent readers compute the loop bound from priv->stats_nch and
then dereference priv->channel_stats[i] using plain accesses, e.g.

for (i = 0; i < priv->stats_nch; i++) {
struct mlx5e_channel_stats *cs = priv->channel_stats[i];
... cs->rq.packets ...
}

On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to
channel_stats[ix] and stats_nch may become visible to other CPUs out
of program order. A reader can observe stats_nch == N while still
seeing channel_stats[N-1] == NULL, leading to a NULL pointer
dereference in the channel_stats loop.

This has been observed in production on BlueField-3 DPUs (arm64),
where ovs-vswitchd queries netdev statistics over netlink during NIC
bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc()
on another CPU:

Unable to handle kernel NULL pointer dereference at virtual address 0x840
Hardware name: BlueField-3 DPU
pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
Call trace:
mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
dev_get_stats+0x50/0xc0
ovs_vport_get_stats+0x38/0xac [openvswitch]
ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]
ovs_vport_cmd_get+0xbc/0x10c [openvswitch]
genl_family_rcv_msg_doit+0xd0/0x160
genl_rcv_msg+0xec/0x1f0
netlink_rcv_skb+0x64/0x130
genl_rcv+0x40/0x60
netlink_unicast+0x2fc/0x370
netlink_sendmsg+0x1dc/0x454
...
__arm64_sys_sendmsg+0x2c/0x40

Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h
that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.
The release/acquire pair establishes the contract:

stats_nch == N => channel_stats[0..N-1] are visible and non-NULL.

Publish the stats_nch increment via mlx5e_stats_nch_write() in the
writer (mlx5e_channel_stats_alloc()), and read stats_nch via
mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,
mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the
sw_stats fold and the HV VHCA stats agent.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from a missing memory barrier when allocating channel statistics for the mlx5e driver. On weakly-ordered CPUs, the store to the channel statistics array and the increment of the statistics counter can become visible out of order to other CPUs. A concurrent reader may observe the counter as N while the array entry for N-1 is still NULL, causing a NULL pointer dereference within the statistics loop. This fault is triggered when an application such as ovs-vswitchd queries netdev statistics during NIC bring‑up while another CPU is allocating channel statistics. The fault manifests as a kernel panic, effectively denying service to the system. This is a classic race condition that results in a NULL pointer dereference (CWE‑476) and can be exploited by local processes that trigger ovs‑vswitchd or other statistics readers.

Affected Systems

The issue is limited to the Linux kernel’s mlx5e driver, which implements Mellanox Ethernet device support. All kernel releases before the patch that introduces the release/acquire logic in channel statistics allocation are affected. The defect has been seen in production on BlueField‑3 DPUs (ARM64), so any ARM, PowerPC, or RISC‑V based system that uses the mlx5e driver and performs concurrent statistics queries is potentially vulnerable. The specific kernel versions are not enumerated in the advisory; users should apply any kernel update that contains the commit that adds the missing memory barriers.

Risk and Exploitability

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability can lead to a system‑wide kernel crash. Because the fault occurs during a normal statistics query, a local attacker with the ability to run privileged or even non‑privileged processes that trigger ovs‑vswitchd or other statistics readers can provoke the race. No KEV listing indicates that this is not an actively exploited vulnerability yet, but the lack of exploitation data does not lessen the impact of a kernel panic. System operators should treat this as a moderate‑risk denial‑of‑service condition until a fix is applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fa691d0c9c0812b9045f3a9420862e47b3b92518`	affected	< 5c7e3755abf663f033de24f917b77685e9543045
`fa691d0c9c0812b9045f3a9420862e47b3b92518`	affected	< 815515ec68f527ca755cb1e2c1ff9148f6b3ea56
`fa691d0c9c0812b9045f3a9420862e47b3b92518`	affected	< 5a799714e8ca0bce9ea40694f49914cf1adbbaa9

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fa691d0c9c0812b9045f3a9420862e47b3b92518,5c7e3755abf663f033de24f917b77685e9543045)`	affected	code_commit	—
`[fa691d0c9c0812b9045f3a9420862e47b3b92518,815515ec68f527ca755cb1e2c1ff9148f6b3ea56)`	affected	code_commit	—
`[fa691d0c9c0812b9045f3a9420862e47b3b92518,5a799714e8ca0bce9ea40694f49914cf1adbbaa9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a Linux kernel that includes the patch adding memory barriers to mlx5e_channel_stats allocation; the patch appears in recent kernel sources.
After applying the update, restart any networking services or reboot the system to ensure the updated mlx5e driver is loaded.
If an immediate kernel update is not possible, avoid querying NIC statistics (e.g., from ovs-vswitchd or other tools) during NIC bring‑up or defer statistics collection until after initialization completes.

Generated by OpenCVE AI on August 22, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00207.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9
https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045
https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56
https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72341-4b02@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72341
https://www.cve.org/CVERecord?id=CVE-2026-72341

History

Sat, 22 Aug 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72341-4b02@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72341 https://www.cve.org/CVERecord?id=CVE-2026-72341
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store carries any memory barrier: priv->channel_stats[ix] = kvzalloc_node(...); if (!priv->channel_stats[ix]) return -ENOMEM; priv->stats_nch++; Concurrent readers compute the loop bound from priv->stats_nch and then dereference priv->channel_stats[i] using plain accesses, e.g. for (i = 0; i < priv->stats_nch; i++) { struct mlx5e_channel_stats *cs = priv->channel_stats[i]; ... cs->rq.packets ... } On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop. This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc() on another CPU: Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] dev_get_stats+0x50/0xc0 ovs_vport_get_stats+0x38/0xac [openvswitch] ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch] ovs_vport_cmd_get+0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit+0xd0/0x160 genl_rcv_msg+0xec/0x1f0 netlink_rcv_skb+0x64/0x130 genl_rcv+0x40/0x60 netlink_unicast+0x2fc/0x370 netlink_sendmsg+0x1dc/0x454 ... __arm64_sys_sendmsg+0x2c/0x40 Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract: stats_nch == N => channel_stats[0..N-1] are visible and non-NULL. Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.
Title		net/mlx5e: Fix publication race for priv->channel_stats[]
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9 https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045 https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:55:47.764Z

Updated: 2026-08-17T05:12:50.055Z

Reserved: 2026-08-09T03:40:39.920Z

Link: CVE-2026-72341

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:07.403

Modified: 2026-08-17T06:18:37.903

Link: CVE-2026-72341

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72341 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T06:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object