CVE-2026-97962: net/mlx5e: Move representor vnic reporter to eswitch devlink port
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Move representor vnic reporter to eswitch devlink port
The representor vnic devlink health reporter is created and destroyed along the representor netdev (un)load path, which is not serialized by the devlink instance lock. Destroying the reporter from there triggers a devlassertlocked() splat on driver unbind: WARNING: net/devlink/core.c:259 at devlassertlocked+0x54/0x70, CPU#2: bash/3758 Modules linked in: mlx5vdpa vringh vdpa mlx5ib mlx5fwctl mlx5core ... CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ... RIP: 0010:devlassertlocked+0x54/0x70 Call Trace: <TASK> devlhealthreporterdestroy+0x3a/0x1b0 mlx5evportrepunload+0x12d/0x2b0 [mlx5core] mlx5eswitchunregistervportreps+0x1b8/0x220 [mlx5core] ? eswoffloadsunloadrep+0x190/0x190 [mlx5core] ? kernfsremovebynamens+0xc3/0xf0 devicereleasedriverinternal+0x3b2/0x560 unbindstore+0xce/0xf0
Move the reporter's lifecycle to the eswitch devlink port (un)register paths, which are already serialized by the devlink instance lock, and store the handle on mlx5devlinkport. Use the port's mlx5vport as the reporter priv since the diagnose callback only needs a device handle and a vport number, and mlx5vport carries both and is initialized before any representor driver probes.
Affected Software
Event History
Frequently Asked Questions
When is the issue triggered?
It is triggered during driver unbind, when representor netdevices are unloaded and the representor vNIC devlink health reporter is destroyed outside the devlink instance lock.
How can I identify the problem in logs?
The kernel may emit a devl_assert_locked() WARNING from net/devlink/core.c. The stack trace includes devl_health_reporter_destroy, mlx5e_vport_rep_unload, mlx5_eswitch_unregister_vport_reps, and device_release_driver_internal.