CVE-2026-22996

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv

mlx5e_priv is an unstable structure that can be memset(0) if profile

attaching fails, mlx5e_priv in mlx5e_dev devlink private is used to

reference the netdev and mdev associated with that struct. Instead,

store netdev directly into mlx5e_dev and get mdev from the containing

mlx5_adev aux device structure.

This fixes a kernel oops in mlx5e_remove when switchdev mode fails due

to change profile failure.

$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev

Error: mlx5_core: Failed setting eswitch to offloads.

dmesg:

workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR

mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12

mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12

workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR

mlx5_core 0012

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References