CVE-2026-64122: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover
mlx5etxreportertimeoutrecover() accesses sq->netdev after mlx5esafereopenchannels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown.
The netdeverr() call already used priv->netdev for this reason; make the trylock/unlock and healthchanneleqrecover calls consistent.
This fixes the following KASAN splat:
BUG: KASAN: use-after-free in mlx5etxreportertimeoutrecover+0x1dd/0x360 [mlx5core] Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277
Call Trace: mlx5etxreportertimeoutrecover+0x1dd/0x360 [mlx5core] devlinkhealthreporterrecover+0xa2/0x150 devlinkhealthreport+0x254/0x7c0 mlx5ereportertxtimeout+0x297/0x380 [mlx5core] mlx5etxtimeoutwork+0x109/0x170 [mlx5core] processonework+0x677/0xf20 workerthread+0x51f/0xd90 kthread+0x3a5/0x810 retfromfork+0x208/0x400 retfromforkasm+0x1a/0x30
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64122?
CVE-2026-64122 has a risk rating of 43.
What type of vulnerability is CVE-2026-64122?
CVE-2026-64122 is classified as a Use After Free vulnerability.
How do I fix CVE-2026-64122?
To fix CVE-2026-64122, update your Linux kernel to the latest patched version.
What component is affected by CVE-2026-64122?
CVE-2026-64122 affects the net/mlx5e component of the Linux kernel.
What triggers the vulnerability in CVE-2026-64122?
CVE-2026-64122 is triggered when mlx5e_tx_reporter_timeout_recover accesses a freed netdev after the teardown of its channel.