CVE-2026-74717

A bug in the Linux kernel’s mlx5 driver mis‑handles tracer‑creation failures, returning an encoded error pointer instead of NULL. The driver code stores the value without distinguishing between ERR_PTR and NULL, and the core‑dump logic dereferences it as if it were a valid address. This dereference causes an oops that escalates to a kernel panic, crashing the host and disrupting all network traffic and services. The flaw is a CWE‑476 (NULL pointer dereference) type vulnerability where the driver incorrectly treats an error pointer as a valid pointer. No remote code execution is described; the failure is confined to internal kernel operations.

The issue affects Linux kernel installations that include the legacy mlx5_core driver, which is part of the Linux kernel's RDMA and Ethernet driver stack. Any kernel version that has not yet incorporated the commit that changes error handling to return only NULL on failure, such as the 6.19.7 build shown in the trace, is potentially vulnerable. The vendor list identifies Linux as the affected product; no specific version range is supplied, so all kernels with the unpatched mlx5 implementation should be considered at risk.

The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, signifying no reported active exploitation. The CVSS score of 7.5 classifies it as high‑severity denial of service. Attackers would need local or privileged access to trigger the faulty tracer path, which is limited to internal kernel operations, implying the attack vector is local. No publicly known exploit exists; however, an attacker could craft a payload that forces tracer creation to induce a kernel panic. Based on the description, it is inferred that the attack vector requires local or privileged access.