CVE-2026-72341
Low risk· EPSS 11%Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel, the mlx5e driver (for Mellanox/NVIDIA network cards) has a race condition when publishing new entries in the priv->channel_stats[] array. Due to missing memory barriers, on weakly-ordered architectures (ARM, PowerPC, RISC-V) a reader may see an updated stats_nch counter but not yet fully visible array entries, leading to a NULL pointer dereference. The issue was observed on BlueField-3 DPU platforms (arm64) during netdev statistics queries over netlink.
Risk Assessment
An attacker (or even routine operations like ovs-vswitchd queries) can cause a kernel panic on systems with mlx5 cards, resulting in network service disruption and potential availability loss. The vulnerability may be exploited locally for privilege escalation or DoS.
Recommendation
Apply the Linux kernel patch that adds helper functions mlx5e_stats_nch_write() and mlx5e_stats_nch_read() with memory barriers (smp_store_release/smp_load_acquire). Update the system to a kernel version containing this fix.
Related vulnerabilities
- CVE-2026-60043Critical
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
- CVE-2026-13312Critical
The described vulnerability could allow an attacker to compromise a system. Technical details are not provided in the description.
- CVE-2026-115646Critical
A partial string comparison vulnerability in HiRDB. The issue affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and Version 9 (from 09-50-06 through 09-66-22), including versions with additional functions.
- CVE-2026-89126Critical
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-89119Critical
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
- CVE-2026-89103Critical
SAP Gateway activates the default Access Control List with high privileges, allowing categorization of an external attacker as an internal application server. An unauthenticated attacker with network access to SAP Gateway could exploit this weakness to perform unauthorized actions within the application environment.
- CVE-2026-76965Critical
SAP NetWeaver Application Server ABAP and ABAP Platform do not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke the affected functionality to execute arbitrary operating system commands on the underlying host.
- CVE-2026-76964Critical
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-125086Critical
D-Link M60 1.12.B01 contains hard-coded credentials in the /etc/emDaemon/mosquitto.conf file of the emDaemon MQTT Broker component. The vulnerability can be exploited remotely, and a public exploit may already be in use.
- CVE-2026-124600Critical
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, allowing an attacker to intercept it.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store carries any memory barrier: priv->channel_stats[ix] = kvzalloc_node(...); if (!priv->channel_stats[ix]) return -ENOMEM; priv->stats_nch++; Concurrent readers compute the loop bound from priv->stats_nch and then dereference priv->channel_stats[i] using plain accesses, e.g. for (i = 0; i < priv->stats_nch; i++) { struct mlx5e_channel_stats *cs = priv->channel_stats[i]; ... cs->rq.packets ... } On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop. This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc() on another CPU: Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] dev_get_stats+0x50/0xc0 ovs_vport_get_stats+0x38/0xac [openvswitch] ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch] ovs_vport_cmd_get+0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit+0xd0/0x160 genl_rcv_msg+0xec/0x1f0 netlink_rcv_skb+0x64/0x130 genl_rcv+0x40/0x60 netlink_unicast+0x2fc/0x370 netlink_sendmsg+0x1dc/0x454 ... __arm64_sys_sendmsg+0x2c/0x40 Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract: stats_nch == N => channel_stats[0..N-1] are visible and non-NULL. Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS