CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: fix wrong list iterated in adddirectchain error path
In adddirectchain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp.
Fix by iterating over 'tmp' in the erralloc cleanup path.
Event History
Frequently Asked Questions
When is the affected cleanup path reached?
It is reached when add_direct_chain() encounters an allocation error after newly allocated direct MR entries have been placed on its local tmp list and before that list is spliced into mr->head.
What does the correction change in the failure path?
The cleanup loop now iterates over tmp, which contains the newly allocated entries at that point. Previously it iterated over mr->head, which is only updated on successful completion.