CVE-2026-72006: net/mlx5: free mlx5_st_idx_data on final dealloc
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: free mlx5stidxdata on final dealloc
Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time.
When the last reference to an ST table entry is dropped, mlx5stdeallocindex() removed the entry from idxxa but the backing mlx5stidxdata allocation was never freed.
Free idxdata after the xaerase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72006?
The severity of CVE-2026-72006 is rated as risk 17.
How do I fix CVE-2026-72006?
To fix CVE-2026-72006, update your Linux kernel to the latest version containing the patch for this vulnerability.
What types of workloads are affected by CVE-2026-72006?
CVE-2026-72006 affects workloads that repeatedly allocate and release mkeys with TPH steering-tag hints, particularly those using RDMA MRs.
What kind of information is leaked due to CVE-2026-72006?
CVE-2026-72006 results in a leak of one struct mlx5_st_idx_data per cycle during the allocation and release of certain workloads.
Is CVE-2026-72006 related to memory management?
Yes, CVE-2026-72006 is related to memory management within the Linux kernel as it deals with the free mlx5_st_idx_data during the final deallocation.