CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

vdpa/mlx5: fix wrong list iterated in adddirectchain error path

In adddirectchain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp.

Fix by iterating over 'tmp' in the erralloc cleanup path.

Event History

Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description

Frequently Asked Questions

1

When is the affected cleanup path reached?

It is reached when add_direct_chain() encounters an allocation error after newly allocated direct MR entries have been placed on its local tmp list and before that list is spliced into mr->head.

2

What does the correction change in the failure path?

The cleanup loop now iterates over tmp, which contains the newly allocated entries at that point. Previously it iterated over mr->head, which is only updated on successful completion.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203