CVE-2026-74397IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked. Fix this by deallocating the TD when mlx5_ib_enable_lb() returns an error. Also return 0 explicitly in the no-loopback-capability success branch, and move dev->lb.mutex initialization to mlx5_ib_stage_init_init().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 146d2f1af3245a10b13eef263687e54f4e253d1d builds before 2c3b2667dad69d56774b79db763acb3a1bee0fc0; 146d2f1af3245a10b13eef263687e54f4e253d1d builds before 37fc3cc0f924fd8d0f0cf87b92672dec75a32e57; 146d2f1af3245a10b13eef263687e54f4e253d1d builds before 65e344925fa30abf50c8de8c150b397715fa2066; from 146d2f1af3245a10b13eef263687e54f4e253d1d before f88e12c95fc19f719e06ca1e9eb20fdad68ef61a; from 146d2f1af3245a10b13eef263687e54f4e253d1d before e79389115b9d27287ff6230a9750675106ed7668 | CNA record |
References
- https://git.kernel.org/stable/c/2c3b2667dad69d56774b79db763acb3a1bee0fc0
- https://git.kernel.org/stable/c/37fc3cc0f924fd8d0f0cf87b92672dec75a32e57
- https://git.kernel.org/stable/c/65e344925fa30abf50c8de8c150b397715fa2066
- https://git.kernel.org/stable/c/f88e12c95fc19f719e06ca1e9eb20fdad68ef61a
- https://git.kernel.org/stable/c/e79389115b9d27287ff6230a9750675106ed7668
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.