CVE-2026-74395

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list

before initializing the fields used by the shared error path.

If eventfd_ctx_fdget() then fails, the unwind path dereferences

event_sub->ev_file in uverbs_uobject_put() and calls

subscribe_event_xa_dealloc() with an unset xa_key_level1.

subscribe_event_xa_alloc() creates the XA entry exactly once for a given

key_level1, on the first occurrence of that key. The unwind path must

therefore call subscribe_event_xa_dealloc() exactly once for it as well.

Enforce that by adding devx_key_in_sub_list() and calling

subscribe_event_xa_dealloc() only when the last matching pending entry is

being cleaned up.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References