CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: fwtracer, return NULL on create error
Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes a crash in the core dump logic, which is missing the ERRPTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: mlx5ib ibuverbs ibcore ipv6 mlx5core CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none) Workqueue: mlx5health0001:01:00.0 mlx5fwreportererrwork [mlx5core] pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : mlx5fwtracertriggercoredumpgeneral+0x58/0xe0 [mlx5core] lr : mlx5fwtracertriggercoredumpgeneral+0x40/0xe0 [mlx5core] sp : ffff800081cf3c40 x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05 x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000 x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0 x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650 x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8 x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e Call trace: mlx5fwtracertriggercoredumpgeneral+0x58/0xe0 [mlx5core] (P) mlx5fwreporterdump+0x30/0x2e0 [mlx5core] devlinkhealthdodump+0x9c/0x160 devlinkhealthreport+0x1c0/0x288 mlx5fwreportererrwork+0xac/0xc0 [mlx5core] processonework+0x15c/0x3d8 workerthread+0x18c/0x320 kthread+0x148/0x228 retfromfork+0x10/0x20 Code: b9400000 5ac00800 7a401800 540003ca (3940a260) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x000000,00078031,75fce5a1,35fffe67 Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.19.7 #1 PREEMPT(none)Patch net/mlx5: fw_tracer, return NULL on create error - Configuration
Apply the kernel fix so mlx5 fw_tracer creation returns NULL on failure only, and callers perform a single NULL check (treating ERR_PTR and NULL equivalently) to avoid dereferencing the failed tracer pointer in devlink_health_do_dump/core-dump logic.
net/mlx5 (mlx5_core) fw_tracer Tracer creation failure handling (NULL/ERR_PTR) = treat ERR_PTR and NULL the same way; switch tracer creation to return NULL on failure only
Event History
Frequently Asked Questions
What systems are exposed to the crash path?
Systems using the mlx5_core driver are exposed when firmware tracer creation fails and returns an ERR_PTR value. The affected path includes mlx5 firmware health reporting and core-dump handling.
What must happen for the failure to occur?
Firmware tracer creation must fail in the mode where it returns ERR_PTR rather than NULL. Callers store that value without distinguishing it from NULL, and the core-dump logic can then dereference it.
How can I recognize this issue in logs or crash traces?
The provided crash trace shows an internal kernel Oops in mlx5_fw_tracer_trigger_core_dump_general within mlx5_core. It is run from the mlx5_fw_reporter_err_work health-reporting workqueue.