UBUNTU-CVE-2026-97962: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev (un)load path, which is not serialized by the devlink instance lock. Destroying the reporter from there triggers a devlassertlocked() splat on driver unbind: WARNING: net/devlink/core.c:259 at devlassertlocked+0x54/0x70, CPU#2: bash/3758 Modules linked in: mlx5vdpa vringh vdpa mlx5ib mlx5fwctl mlx5core ... CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ... RIP: 0010:devlassertlocked+0x54/0x70 Call Trace: <TASK> devlhealthreporterdestroy+0x3a/0x1b0 mlx5evportrepunload+0x12d/0x2b0 [mlx5core] mlx5eswitchunregistervportreps+0x1b8/0x220 [mlx5core] ? eswoffloadsunloadrep+0x190/0x190 [mlx5core] ? kernfsremovebynamens+0xc3/0xf0 devicereleasedriverinternal+0x3b2/0x560 unbindstore+0xce/0xf0 Move the reporter's lifecycle to the eswitch devlink port (un)register paths, which are already serialized by the devlink instance lock, and store the handle on mlx5devlinkport. Use the port's mlx5vport as the reporter priv since the diagnose callback only needs a device handle and a vport number, and mlx5vport carries both and is initialized before any representor driver probes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Move the representor vNIC health reporter lifecycle to the eswitch devlink port register/unregister paths, which are serialized by the devlink instance lock; use the port's mlx5_vport as the reporter private data and store the reporter handle on mlx5_devlink_port.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using the mlx5_core driver with representor netdevices and the eswitch functionality are the relevant population. The reported warning occurs during driver unbind while unregistering vport representors.
What must happen to trigger the warning?
The mlx5 representor vNIC health reporter must be destroyed through the representor netdevice unload path during driver unbind. That path was not serialized by the devlink instance lock, causing the devl_assert_locked() warning.
Is this described as a remote compromise issue?
No. The provided information describes a kernel warning during local driver lifecycle handling, specifically driver unbind; it does not describe remote exploitation, privilege escalation, or data exposure.
What changes in the resolved implementation?
The reporter lifecycle is moved to the eswitch devlink port registration and unregistration paths. Those paths are already serialized by the devlink instance lock.