CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Drain RCU callbacks during module teardown
devxfreesubscription() can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the callback runs.
Registration error unwind has the same risk because driver registration can attach existing devices before failing. Wait after all drivers have stopped.
Event History
Frequently Asked Questions
When can this issue be triggered?
The risk arises during mlx5_ib module teardown, including after the last DevX event file releases its module reference, when an auxiliary driver detaches devices, or during driver-registration error cleanup after existing devices were attached.
What must be true for exploitation or failure to occur?
An RCU callback from devx_free_subscription() must still be queued when mlx5_ib unloads. The issue is tied to DevX event subscription cleanup or to the registration-unwind path.
What should operators do if they cannot immediately deploy the fix?
Avoid unloading the mlx5_ib module while DevX event files or auxiliary-driver device detach activity may leave subscription cleanup callbacks pending. The resolved behavior waits for queued RCU callbacks after all drivers have stopped.