CVE-2026-74395 - Vulnerability Details

- RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
before initializing the fields used by the shared error path.

If eventfd_ctx_fdget() then fails, the unwind path dereferences
event_sub->ev_file in uverbs_uobject_put() and calls
subscribe_event_xa_dealloc() with an unset xa_key_level1.

subscribe_event_xa_alloc() creates the XA entry exactly once for a given
key_level1, on the first occurrence of that key. The unwind path must
therefore call subscribe_event_xa_dealloc() exactly once for it as well.

Enforce that by adding devx_key_in_sub_list() and calling
subscribe_event_xa_dealloc() only when the last matching pending entry is
being cleaned up.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when an application attempts to subscribe to an RDMA devx event and a file descriptor lookup fails. The cleanup routine then dereferences an uninitialized pointer `event_sub->ev_file`, causing a NULL pointer dereference in kernel space. This can lead to a kernel panic and a system reboot. The vulnerability is a classic NULL pointer dereference (CWE‑476).

Affected Systems

Any Linux kernel that includes the MLX5 driver with the devx event subscription method and has not yet incorporated the commit that enforces proper cleanup. The affected range covers all unpatched kernels shipping the driver; no specific release is singled out, so all such kernels are potentially impacted.

Risk and Exploitability

The CVSS score of 5.5 places this flaw in the medium severity range. The EPSS score of <1% indicates a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog. While the exploit appears to require access to the devx interface—likely local or privileged—the description does not explicitly state a remote attack vector. The potential impact is a system crash, but the overall risk is moderated by the low exploitation probability and lack of confirmed remote exploitability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 6e15b770461eeaa0ff73934922cb670a6a9db04e
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 9be9aca28424228586fe9211c373ebdb826ebb6c
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< f345e744b6b087188cde2377da5cbe9713b61353
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 1025dc2f7ba29b04b8687790fa91f9cd1a53141e
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 7921821fc2b19c01588311f6e7468ae5b68b1f61
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 5100febf8e9d6c8c5ba8dc6534c6a5e3376e5989
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 78b9589fda266c71f0f9d0c858d4fa7381a890a5
`7597385371425febdaa8c6a1da3625d4ffff16f5`	affected	< 43f8f7946814c8e5f464518246fdbc69b6e32326

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7597385371425febdaa8c6a1da3625d4ffff16f5,6e15b770461eeaa0ff73934922cb670a6a9db04e)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,9be9aca28424228586fe9211c373ebdb826ebb6c)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,f345e744b6b087188cde2377da5cbe9713b61353)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,1025dc2f7ba29b04b8687790fa91f9cd1a53141e)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,7921821fc2b19c01588311f6e7468ae5b68b1f61)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,5100febf8e9d6c8c5ba8dc6534c6a5e3376e5989)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,78b9589fda266c71f0f9d0c858d4fa7381a890a5)`	affected	code_commit	—
`[7597385371425febdaa8c6a1da3625d4ffff16f5,43f8f7946814c8e5f464518246fdbc69b6e32326)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit fixing the devx subscribe–event unwind NULL dereference.
If an immediate upgrade is not possible, disable the MLX5/RDMA devx subsystem by removing the kernel module or disabling the corresponding configuration options until a patched kernel is available.
Monitor system logs for signs of kernel panics or abnormal activity and apply the patch as soon as it is released.

Generated by OpenCVE AI on August 21, 2026 at 23:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1025dc2f7ba29b04b8687790fa91f9cd1a53141e
https://git.kernel.org/stable/c/43f8f7946814c8e5f464518246fdbc69b6e32326
https://git.kernel.org/stable/c/5100febf8e9d6c8c5ba8dc6534c6a5e3376e5989
https://git.kernel.org/stable/c/6e15b770461eeaa0ff73934922cb670a6a9db04e
https://git.kernel.org/stable/c/78b9589fda266c71f0f9d0c858d4fa7381a890a5
https://git.kernel.org/stable/c/7921821fc2b19c01588311f6e7468ae5b68b1f61
https://git.kernel.org/stable/c/9be9aca28424228586fe9211c373ebdb826ebb6c
https://git.kernel.org/stable/c/f345e744b6b087188cde2377da5cbe9713b61353
https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-74395-4139@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74395
https://www.cve.org/CVERecord?id=CVE-2026-74395

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081508-CVE-2026-74395-4139@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74395 https://www.cve.org/CVERecord?id=CVE-2026-74395
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdget() then fails, the unwind path dereferences event_sub->ev_file in uverbs_uobject_put() and calls subscribe_event_xa_dealloc() with an unset xa_key_level1. subscribe_event_xa_alloc() creates the XA entry exactly once for a given key_level1, on the first occurrence of that key. The unwind path must therefore call subscribe_event_xa_dealloc() exactly once for it as well. Enforce that by adding devx_key_in_sub_list() and calling subscribe_event_xa_dealloc() only when the last matching pending entry is being cleaned up.
Title		RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1025dc2f7ba29b04b8687790fa91f9cd1a53141e https://git.kernel.org/stable/c/43f8f7946814c8e5f464518246fdbc69b6e32326 https://git.kernel.org/stable/c/5100febf8e9d6c8c5ba8dc6534c6a5e3376e5989 https://git.kernel.org/stable/c/6e15b770461eeaa0ff73934922cb670a6a9db04e https://git.kernel.org/stable/c/78b9589fda266c71f0f9d0c858d4fa7381a890a5 https://git.kernel.org/stable/c/7921821fc2b19c01588311f6e7468ae5b68b1f61 https://git.kernel.org/stable/c/9be9aca28424228586fe9211c373ebdb826ebb6c https://git.kernel.org/stable/c/f345e744b6b087188cde2377da5cbe9713b61353

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:59:07.798Z

Updated: 2026-08-17T05:18:34.634Z

Reserved: 2026-08-15T05:44:03.891Z

Link: CVE-2026-74395

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:41.480

Modified: 2026-08-17T06:19:34.557

Link: CVE-2026-74395

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74395 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T00:00:16Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object