CVE-2026-74717

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: fw_tracer, return NULL on create error

Tracer creation can fail by returning either NULL or ERR_PTR.

The return value is stored without a check on the device, and users

treat ERR_PTR and NULL the same way.

This also causes a crash in the core dump logic, which is missing the

ERR_PTR check and ends up dereferencing it, as shown in the trace below.

Switch tracer creation to return NULL on failure only, so callers only

need a single NULL check.

Internal error: Oops: 0000000096000006 [#1] SMP

Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core

CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)

Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]

pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)

pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]

lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References