What is the CVSS score of CVE-2026-74396?

CVE-2026-74396 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74396?

A kernel-level resource leak and mutex deadlock in the Linux RDMA/mlx5 driver (CVE-2026-74396) creates denial-of-service risk for organizations operating NVIDIA ConnectX-based infrastructure in HPC,…. A patch is available.

How to fix or mitigate CVE-2026-74396?

Within 24 hours, query infrastructure management tools to identify all systems running Linux 6.16+ with RDMA/mlx5 driver enabled and inventory which production assets depend on NVIDIA ConnectX connectivity. Within 7 days, apply the vendor-released kernel patch to staging and non-production systems, validate RDMA connectivity and performance benchmarks post-patch, and stage updates for production windows. Within 30 days, execute patching of all production systems during scheduled maintenance, prioritizing storage and HPC cluster nodes, and confirm patch application via kernel version audit across the fleet.

Linux Kernel CVE-2026-74396

EUVD-2026-59543 HIGH

2026-08-15 Linux

GHSA-2vqx-xvhw-m854

Information Disclosure Linux Red Hat

High

Disputed · 7.5 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

RDMA fabric participation implies at least low-privilege access context (PR:L); no confidentiality or integrity impact; availability is High due to mutex deadlock and DMA resource exhaustion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:03 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.5 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:59 cve.org

HIGH 7.5

CVE Published

Aug 15, 2026 - 05:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_umr_unmap_free_xlt().

After mlx5_odp_populate_xlt() became fallible, its error path returned directly and skipped that cleanup. This leaks the XLT DMA mapping and buffer. If the emergency XLT page was used, it also leaves xlt_emergency_page_mutex locked.

Break out of the loop so execution falls through the existing cleanup path.

AnalysisAI

Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Access RDMA fabric or local verbs interface

Delivery

Initiate ODP-backed memory registration via mlx5 UMR

Exploit

Induce mlx5_odp_populate_xlt() failure via memory pressure

Execution

Error path skips mlx5r_umr_unmap_free_xlt() cleanup

Persist

DMA buffer and mapping leaked; emergency mutex left locked

Impact

RDMA subsystem deadlocks, host availability degraded until reboot

Access

Access RDMA fabric or local verbs interface

Delivery

Initiate ODP-backed memory registration via mlx5 UMR

Exploit

Induce mlx5_odp_populate_xlt() failure via memory pressure

Execution

Error path skips mlx5r_umr_unmap_free_xlt() cleanup

Persist

DMA buffer and mapping leaked; emergency mutex left locked

Impact

RDMA subsystem deadlocks, host availability degraded until reboot

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target host to have a Mellanox or NVIDIA mlx5-compatible RDMA network adapter (ConnectX series) installed with the mlx5_ib kernel module loaded and On-Demand Paging (ODP) enabled - ODP support depends on both hardware capability advertisement and kernel configuration and is not universally enabled by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS score of 7.5 with vector AV:N/AC:L/PR:N/UI:N warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An RDMA peer or local process with access to the mlx5 RDMA interface initiates an ODP memory registration operation against a vulnerable kernel, deliberately or incidentally causing mlx5_odp_populate_xlt() to fail - for example, by creating memory pressure conditions that exhaust allocation resources mid-operation. The kernel error path executes the direct return rather than cleanup, leaking the DMA buffer; if the emergency XLT page path was reached, xlt_emergency_page_mutex is permanently locked. …
Remediation	Upgrade the Linux kernel to version 7.1.5, 6.18.40, or 7.2-rc1 or later, applying the appropriate stable-branch fix commit: ffa85a2c197935ace6f1634ad9eb0a44bc615670, 9619909d4869afe720904c6888a289b9ac3055b8, or 1eae35b37923cb71b0cb5136d00671440d488b9f, available at https://git.kernel.org/stable/c/ffa85a2c197935ace6f1634ad9eb0a44bc615670. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, query infrastructure management tools to identify all systems running Linux 6.16+ with RDMA/mlx5 driver enabled and inventory which production assets depend on NVIDIA ConnectX connectivity. …

Threat intelligence, references, and detailed analysis are available after sign-in.