CVE-2026-72341

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix publication race for priv->channel_stats[]

mlx5e_channel_stats_alloc() publishes a new entry to

priv->channel_stats[] and then increments priv->stats_nch as a

publication token, but neither store carries any memory barrier:

priv->channel_stats[ix] = kvzalloc_node(...);

if (!priv->channel_stats[ix])

return -ENOMEM;

priv->stats_nch++;

Concurrent readers compute the loop bound from priv->stats_nch and

then dereference priv->channel_stats[i] using plain accesses, e.g.

for (i = 0; i < priv->stats_nch; i++) {

struct mlx5e_channel_stats *cs = priv->channel_stats[i];

... cs->rq.packets ...

}

On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to

channel_stats[ix] and stats_nch may become visible to other CPUs out

of program order. A reader can observe stats_nch == N while still

seeing channel_stats[N-1] == NULL, leading to a NULL pointer

dereference in the channel_stats loop.

This

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References