CVE-2026-22996: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22996 Overview

CVE-2026-22996 is a Null Pointer Dereference vulnerability in the Linux kernel's Mellanox mlx5e network driver. The vulnerability exists in the devlink private data handling where an unstable mlx5e_priv structure is stored in the mlx5e_dev devlink private area. When profile attachment fails, this structure can be zeroed out via memset(0), leading to a kernel NULL pointer dereference during subsequent device removal operations.

The flaw manifests when switching the eswitch to switchdev mode fails due to profile change failures. Upon attempting a devlink device reload, the kernel triggers an oops due to accessing the zeroed structure at offset 0x520, causing system instability and potential denial of service conditions.

Critical Impact

This vulnerability can cause kernel crashes and system instability when mlx5 network devices fail profile changes, potentially leading to denial of service conditions on affected Linux systems.

Affected Products

• Linux kernel with mlx5e (Mellanox ConnectX) network driver support
• Systems using mlx5_core module with devlink switchdev mode
• QEMU/KVM virtual environments with mlx5 passthrough configurations

Discovery Timeline

• 2026-01-25 - CVE CVE-2026-22996 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-22996

Vulnerability Analysis

The vulnerability stems from improper handling of the mlx5e_priv structure within the devlink private data context. The mlx5e_priv structure is used to reference the netdev and mdev (Mellanox device) associated with the mlx5e driver instance. However, this structure is inherently unstable—when profile attachment fails during operations like eswitch mode changes, the structure is cleared using memset(0).

The problem occurs in the mlx5e_remove function at offset 0x68, where the code attempts to access memory at address 0x520 (NULL + offset) after the structure has been zeroed. This happens because the devlink private data still contains a pointer to the now-invalid structure. The call trace shows the crash occurring during device release operations triggered by devlink_reload, specifically through mlx5_detach_device and mlx5_unload_one_devl_locked.

The kernel log output demonstrates the failure sequence: first, workqueue creation fails with -EINTR, then mlx5e_priv_init fails with -12 (ENOMEM), and finally the profile rollback also fails. When a subsequent reload is attempted, the kernel encounters the NULL pointer dereference.

Root Cause

The root cause is an architectural design flaw in how the mlx5e driver manages the relationship between devlink private data and the mlx5e_priv structure. By storing a pointer to mlx5e_priv in the devlink private area, the code creates a dangling reference scenario when profile initialization fails and the structure is cleared.

The fix involves storing the netdev directly into mlx5e_dev and obtaining the mdev from the containing mlx5_adev auxiliary device structure, eliminating the dependency on the unstable mlx5e_priv structure.

Attack Vector

This vulnerability is triggered through local system operations, specifically:

1. An administrator or privileged user issues a devlink command to change the eswitch mode to switchdev
2. The profile change fails (potentially due to resource exhaustion or interruption)
3. The mlx5e_priv structure is zeroed during cleanup
4. A subsequent devlink reload command causes the kernel to access the zeroed structure
5. The NULL pointer dereference triggers a kernel oops, causing system crash or instability

The attack requires local access with sufficient privileges to execute devlink commands. While not remotely exploitable, this vulnerability can be leveraged for denial of service attacks or potentially as part of a larger exploit chain targeting systems with mlx5 hardware.

Detection Methods for CVE-2026-22996

Indicators of Compromise

• Kernel oops messages containing mlx5e_remove in the call trace
• NULL pointer dereference errors at address 0x0000000000000520
• Log entries showing mlx5e_priv_init failed followed by profile rollback failures
• Workqueue creation failures for "mlx5e" with -EINTR error codes

Detection Strategies

• Monitor kernel logs (dmesg) for BUG: kernel NULL pointer dereference messages associated with mlx5 operations
• Implement auditd rules to track devlink eswitch mode change commands
• Deploy kernel crash dump analysis to identify mlx5e_remove in stack traces
• Configure SentinelOne Singularity agent to detect kernel panic events and driver-related crashes

Monitoring Recommendations

• Enable persistent kernel logging to capture crash events across reboots
• Configure kernel crash dump collection (kdump) for post-mortem analysis
• Monitor for failed eswitch mode transitions via netlink socket monitoring
• Set up alerting for mlx5_core driver error messages indicating profile failures

How to Mitigate CVE-2026-22996

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Avoid switching eswitch modes on production systems until patched
• Monitor mlx5 driver operations for failure conditions that could trigger the vulnerability
• Consider temporarily disabling switchdev mode functionality if not required

Patch Information

The vulnerability has been addressed through kernel patches that modify how the mlx5e driver manages netdev references. The fix stores netdev directly into mlx5e_dev instead of referencing it through the unstable mlx5e_priv structure. Patches are available through the following kernel git commits:

• Kernel Git Commit 123eda2e
• Kernel Git Commit a3d4f87d
• Kernel Git Commit dcb2ad75

Workarounds

• Avoid using devlink eswitch mode switchdev transitions until the kernel is patched
• Implement resource limits to prevent workqueue creation failures that trigger the vulnerability
• Disable automatic device reload operations for mlx5 devices in high-availability environments
• Consider using alternative networking configurations that don't require switchdev mode

# Configuration example
# Check current eswitch mode (do not change if unpatched)
devlink dev eswitch show pci/0000:00:03.0

# Verify kernel version includes the fix
uname -r

# Check for mlx5_core module version
modinfo mlx5_core | grep version

# Monitor for vulnerability indicators
dmesg | grep -E "mlx5e_priv_init failed|NULL pointer dereference.*mlx5"