EUVD-2026-59544
GHSA-85rj-hfqq-77v3
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only, hardware-specific (mlx5 required), AC:H for engineered error-path; A:H for resource exhaustion; C:L for possible TD memory exposure; I:N unconfirmed.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked.
Fix this by deallocating the TD when mlx5_ib_enable_lb() returns an error. Also return 0 explicitly in the no-loopback-capability success branch, and move dev->lb.mutex initialization to mlx5_ib_stage_init_init().
AnalysisAI
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local authenticated access to the target system (CVSS PR:L confirmed); (2) the system must have a Mellanox/NVIDIA ConnectX adapter present and the mlx5_ib kernel module loaded (hardware-specific precondition); (3) the attacker must be able to invoke IB/RDMA operations - typically requiring membership in the 'rdma' group or root-equivalent access to InfiniBand device nodes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) appears inflated relative to the described defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with at least standard user privileges on a Linux system equipped with a Mellanox/NVIDIA ConnectX adapter could repeatedly invoke RDMA operations that trigger the mlx5 transport domain allocation path, engineering conditions under which mlx5_ib_enable_lb() returns an error (e.g., by exhausting loopback table entries or via a race). Each failed attempt leaks one TD object from kernel memory. … |
| Remediation | The upstream fix is available across multiple stable branches via the Linux kernel stable tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems equipped with Mellanox/NVIDIA ConnectX InfiniBand hardware, document their current kernel versions, and verify patch availability through your Linux distribution's security advisories for CVE-2026-74397. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today