CVE-2026-74717 Overview
CVE-2026-74717 is a null pointer dereference vulnerability in the Linux kernel's Mellanox mlx5 firmware tracer subsystem. The flaw resides in the net/mlx5: fw_tracer code path, where tracer creation can fail by returning either NULL or ERR_PTR. Callers, including the core dump logic in mlx5_fw_tracer_trigger_core_dump_general, do not distinguish between the two failure modes and dereference the returned pointer. This triggers a kernel Oops and a fatal exception, panicking the system. The vulnerability affects Linux systems running the mlx5_core driver used by Mellanox/NVIDIA ConnectX network adapters.
Critical Impact
Remote or local conditions that trigger firmware tracer errors can cause a kernel panic, resulting in denial of service on affected hosts running the mlx5_core driver.
Affected Products
- Linux kernel builds including the mlx5_core driver prior to the fix commits
- Systems using Mellanox/NVIDIA ConnectX network adapters with mlx5_ib and mlx5_core modules
- Kernel version 6.19.7 confirmed vulnerable in the reported crash trace
Discovery Timeline
- 2026-08-22 - CVE-2026-74717 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74717
Vulnerability Analysis
The vulnerability stems from inconsistent error return semantics in the mlx5 firmware tracer creation path. Tracer creation may fail by returning NULL or by returning an ERR_PTR encoding an errno value. Callers store the returned pointer on the device structure without any validation. Downstream consumers, including the health reporter and core dump paths, only test for NULL before dereferencing.
When firmware tracer creation returns an ERR_PTR, the NULL check passes and the code proceeds to dereference an invalid kernel address. The crash trace shows mlx5_fw_tracer_trigger_core_dump_general+0x58 faulting during mlx5_fw_reporter_err_work, invoked by the devlink health subsystem. The resulting Oops produces a fatal exception and kernel panic.
The fix normalizes the failure contract: tracer creation now returns NULL on failure exclusively, so a single NULL check at each call site is sufficient.
Root Cause
The root cause is an API contract mismatch between producer and consumer. The mlx5_fw_tracer_create function returns two distinct error representations, while callers treat only NULL as failure. This is a classic null pointer dereference [CWE-476] combined with improper check for unusual conditions [CWE-754].
Attack Vector
An attacker capable of inducing firmware tracer initialization failures, or of triggering the health reporter error work queue path (mlx5_fw_reporter_err_work), can force the kernel to dereference an ERR_PTR value. The result is a kernel panic and host denial of service. The CVSS vector indicates a network-adjacent path with no privileges required, consistent with malformed network conditions or firmware error events that reach the tracer subsystem.
No public exploit code is available. Refer to the upstream kernel commits listed in the references for the technical fix.
Detection Methods for CVE-2026-74717
Indicators of Compromise
- Kernel Oops messages referencing mlx5_fw_tracer_trigger_core_dump_general in dmesg or /var/log/kern.log
- Unexpected kernel panics on hosts running the mlx5_core module with call traces including mlx5_fw_reporter_err_work and devlink_health_do_dump
- Repeated mlx5_health workqueue entries preceding a system crash or reboot
Detection Strategies
- Inventory Linux hosts running the mlx5_core and mlx5_ib kernel modules using lsmod or configuration management tooling
- Compare running kernel versions against the fixed commits published on git.kernel.org for affected stable branches
- Correlate host crash telemetry with mlx5 firmware health events reported via devlink health show
Monitoring Recommendations
- Forward kernel ring buffer and kdump output to a centralized logging platform for panic detection
- Alert on mlx5_fw_reporter health events and repeated devlink_health_report entries
- Track unexpected reboots on hosts with Mellanox/NVIDIA ConnectX adapters and correlate with firmware error timelines
How to Mitigate CVE-2026-74717
Immediate Actions Required
- Identify all Linux hosts loading the mlx5_core driver and prioritize patching those exposed to untrusted networks
- Apply the upstream stable kernel updates that include the fix commits for net/mlx5: fw_tracer, return NULL on create error
- Reboot patched hosts to load the fixed kernel and verify the tracer initialization path
Patch Information
The fix is available across multiple stable branches. Apply the kernel update containing one of the following commits: 04599570, 47fe0d25, 4aafa600, 80094352, 9a416f00, af39eb11, b1d6375b, or ee41ea49. Consume the fix via your distribution's official kernel update channel where possible.
Workarounds
- On non-critical hosts where mlx5 firmware tracing is not required, evaluate disabling firmware tracer functionality through kernel module parameters if supported by the distribution
- Restrict administrative and network access to hosts running vulnerable mlx5_core versions until patches are deployed
- Configure kdump and automated recovery to reduce downtime if a panic occurs before patching completes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
