HIGH Introduced in 5.9
vdpa DirectChain UAF
CVE-2026-90128
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path In add_direct_chain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp. Fix by iterating over 'tmp' in the err_alloc cleanup path.
02KernelScan AI Analysis
Risk summary
Systems using Mellanox/NVIDIA ConnectX hardware with the vDPA subsystem are affected by a use-after-free and memory leak in the memory region setup error path. When an allocation fails during direct MR chain construction, the cleanup code iterates the wrong list, leaking newly allocated entries and potentially freeing objects still in active use. Exploitation requires a local user with access to vDPA configuration and specific Mellanox PCIe hardware.
Vulnerability analysis
The error cleanup path in the mlx5 vDPA driver's memory region registration code iterates over the wrong list when an allocation failure occurs. Newly allocated memory region entries are collected on a temporary list that is only merged into the active list on success, but the error handler walks the active list instead. This leaks the temporary entries and, when the active list already contains entries from prior operations, incorrectly tears down and frees objects that remain in use, creating a use-after-free condition. The fix corrects the error path to iterate the temporary list so only the entries that were allocated in the current failed attempt are cleaned up. This code path is reachable only on systems with Mellanox ConnectX hardware using the vDPA subsystem, and triggering it requires a local process with access to vDPA memory region configuration along with a memory allocation failure during that operation.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.9 | 6.1.188 | 22d52af9e26a |
| 6.12 | 5.9 | 6.12.110 | 637d867530da |
| 6.18 | 5.9 | 6.18.52 | 6ca752850de3 |
| mainline | 5.9 | 7.3-rc1 | 23ae56d9e74c |
| 7.2 | 5.9 | 7.2.6 | c678d04ac9e5 |
| 5.10 | 5.9 | 5.10.270 | c93defccf5eb |
| 5.15 | 5.9 | 5.15.221 | ed3462365636 |
| 6.6 | 5.9 | 6.6.157 | eeac2ea4ad26 |
| cip/6.12 | 5.9 | 6.12.111-cip32 | 637d867530da |