CVE-2026-64122: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64122 Overview

CVE-2026-64122 is a use-after-free vulnerability in the Linux kernel's Mellanox mlx5e Ethernet driver. The flaw resides in mlx5e_tx_reporter_timeout_recover(), which dereferences sq->netdev after mlx5e_safe_reopen_channels() has already torn down and freed the send queue (SQ) and its embedded channel structures. The stale pointer access is triggered during transmit timeout recovery and produces a KASAN use-after-free splat under mlx5e_tx_timeout_work. The upstream fix replaces the three unsafe sq->netdev references with priv->netdev, which outlives channel teardown.

Critical Impact
A use-after-free in the kernel networking path can lead to memory corruption, kernel crashes, and potential privilege escalation on systems using Mellanox ConnectX network adapters.

Affected Products

Linux kernel net/mlx5e driver (Mellanox ConnectX Ethernet)
Distributions shipping affected upstream mlx5_core module versions
Systems using Mellanox NICs with devlink health TX reporter enabled

Discovery Timeline

2026-07-19 - CVE-2026-64122 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64122

Vulnerability Analysis

The vulnerability is a classic use-after-free [CWE-416] in the transmit timeout recovery path of the mlx5_core kernel module. When a TX timeout is detected, the kernel schedules mlx5e_tx_timeout_work, which invokes the devlink health reporter chain and eventually calls mlx5e_tx_reporter_timeout_recover(). Inside this recovery routine, mlx5e_safe_reopen_channels() tears down the existing channel and frees the send queue objects that it embeds.

After the reopen call returns, the function continues to reference sq->netdev in the trylock, unlock, and health_channel_eq_recover code paths. Because the SQ backing memory has been freed, these dereferences read freed memory. KASAN reports the fault as a use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 with an 8-byte read from freed slab memory.

Root Cause

The root cause is a lifetime mismatch between the send queue object and the surrounding recovery logic. The sq structure is embedded in the channel and shares its lifetime, but the recovery routine assumes sq->netdev remains valid across the reopen operation. The netdev_err() call in the same function correctly used priv->netdev because priv outlives channel teardown; the remaining call sites were not updated for consistency, leaving three dangling sq->netdev accesses.

Attack Vector

Exploitation requires triggering the TX timeout recovery path on a system using the mlx5e driver. An adversary able to induce transmit stalls, for example through crafted traffic patterns or resource exhaustion against the NIC queues, can force the kernel to enter the vulnerable recovery routine. The freed memory read can crash the kernel and, depending on slab reuse timing, may be leveraged for memory corruption. See the upstream fixes at Kernel Git Commit 152295a, Kernel Git Commit 1604a2d, and Kernel Git Commit 7d260c5.

// No verified proof-of-concept code is available.
// The vulnerability is documented via the upstream KASAN splat:
//   BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360
//   Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2

Detection Methods for CVE-2026-64122

Indicators of Compromise

KASAN report entries containing use-after-free in mlx5e_tx_reporter_timeout_recover in dmesg or the kernel ring buffer.
Repeated mlx5e_tx_timeout_work invocations followed by kernel oops or panic on hosts with Mellanox NICs.
Devlink health reporter events for the tx reporter transitioning to error state on mlx5_core devices.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free reads in the mlx5e TX recovery path before deployment.
Correlate netdev_err() messages from mlx5_core with subsequent kernel stack traces referencing mlx5e_safe_reopen_channels.
Inventory hosts running vulnerable mlx5_core versions and match against fixed commit hashes 152295a, 1604a2d, and 7d260c5.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a central log store and alert on KASAN, Oops, or mlx5e_tx_timeout strings.
Track TX timeout counters via ethtool -S and devlink health show for anomalous recovery events on Mellanox interfaces.
Monitor unplanned kernel restarts on hosts equipped with ConnectX adapters to identify possible triggering of this code path.

How to Mitigate CVE-2026-64122

Immediate Actions Required

Identify all Linux hosts loading the mlx5_core module using lsmod | grep mlx5_core and prioritize those with Mellanox ConnectX NICs.
Apply the upstream stable kernel updates that include commits 152295a, 1604a2d, and 7d260c5.
Restrict local and remote users who can induce TX stalls on affected interfaces until patches are deployed.

Patch Information

The fix replaces the three unsafe sq->netdev references in mlx5e_tx_reporter_timeout_recover() with priv->netdev, aligning the trylock, unlock, and health_channel_eq_recover calls with the existing netdev_err() usage. Patched code is available in Kernel Git Commit 152295a, Kernel Git Commit 1604a2d, and Kernel Git Commit 7d260c5. Apply the distribution kernel that backports these commits.

Workarounds

No documented software workaround eliminates the flaw; only the upstream patch removes the stale pointer access.
Where patching is delayed, reduce exposure by isolating vulnerable hosts on trusted network segments and limiting untrusted traffic that could induce TX timeouts.
Consider disabling devlink health auto-recover on affected interfaces to avoid the vulnerable recovery routine, accepting reduced automatic recovery behavior.

bash

# Verify the loaded mlx5_core module and kernel version
uname -r
modinfo mlx5_core | grep -E '^(version|srcversion|filename)'

# Inspect devlink health TX reporter state on Mellanox devices
devlink health show

# After patching, confirm the fixed commits are present in the kernel source tree
git -C /usr/src/linux log --oneline | grep -E '152295a|1604a2d|7d260c5'