CVE-2026-72343

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

mlx5e_hv_vhca_stats_create() is called from mlx5e_nic_enable(),

before mlx5e_open(). At that point priv->stats_nch is still zero,

because it is only ever incremented in mlx5e_channel_stats_alloc(),

which is reached only from mlx5e_open_channel().

mlx5e_hv_vhca_stats_buf_size() therefore returns 0, and

kvzalloc(0, GFP_KERNEL) returns ZERO_SIZE_PTR ((void *)16) rather

than NULL. The "if (!buf)" guard does not catch this, and

mlx5e_hv_vhca_stats_create() completes "successfully" with

priv->stats_agent.buf set to ZERO_SIZE_PTR.

Once channels are opened (priv->stats_nch > 0) and the hypervisor

enables stats reporting, mlx5e_hv_vhca_stats_work() recomputes

buf_len using the new non-zero stats_nch and calls

memset(buf, 0, buf_len) on ZERO_SIZE_PTR, faulting at address 0x10.

Allocate the buffer based on priv->max_nch, which is set in

mlx5e_priv_init() and is the up

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References