CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix memory leak in GETDATADIRECTSYSFSPATH handler
The UVERBSHANDLER(MLX5IBMETHODGETDATADIRECTSYSFSPATH) function allocates memory for the device path using kobjectgetpath(). If the length of the device path exceeds the output buffer length, the function returns -ENOSPC but does not free the allocated memory, resulting in a memory leak.
Add a kfree() call to the error path to ensure the allocated memory is properly freed.
Compile tested only. Issue found using a prototype static analysis tool and code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
In the Linux kernel RDMA/mlx5 driver, modify UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) so that when kobject_get_path() allocates memory and the handler returns -ENOSPC (device path length exceeds the output buffer), the allocated memory is freed by calling kfree() on the pointer before returning.
- Operational
Rebuild (compile) the kernel with the modified RDMA/mlx5 code (compile-tested only), run validation tests, and deploy the updated kernel binary.