Linux Kernel EUVD-2026-59544

Exploitation requires: (1) local authenticated access to the target system (CVSS PR:L confirmed); (2) the system must have a Mellanox/NVIDIA ConnectX adapter present and the mlx5_ib kernel module loaded (hardware-specific precondition); (3) the attacker must be able to invoke IB/RDMA operations - typically requiring membership in the 'rdma' group or root-equivalent access to InfiniBand device nodes. The leak is triggered only when mlx5_ib_enable_lb() returns an error after a successful TD allocation, which may require engineering specific failure conditions (e.g., device resource exhaustion). The mutex initialization race is limited to the driver initialization window. Exploitation is constrained by: local-only attack vector, hardware dependency (mlx5 ConnectX required), RDMA subsystem access controls, and the need to reliably trigger a specific error-path condition. Remote exploitation is not applicable.

The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) appears inflated relative to the described defect. A transport domain leak is a resource management flaw; C:H and I:H are difficult to justify from the description alone unless the leaked TD can be dereferenced or reused in a way that exposes or corrupts kernel memory - which the description does not confirm. The 'Information Disclosure' tag suggests some kernel memory exposure is possible, but its mechanism is not specified. EPSS at 0.17% (7th percentile) strongly corroborates low real-world exploitation interest. This CVE is not listed in CISA KEV and no public proof-of-concept is identified. The primary realistic risk is local denial of service through repeated triggering of the error path to exhaust kernel TD objects, and potentially a kernel panic from the uninitialised mutex if hit before initialization completes. CVSS AV:L/PR:L correctly gates the risk behind local access on hardware-specific systems. Net assessment: low practical priority outside of HPC or RDMA-heavy data center environments; patch during the next maintenance window rather than emergency.

A local user with at least standard user privileges on a Linux system equipped with a Mellanox/NVIDIA ConnectX adapter could repeatedly invoke RDMA operations that trigger the mlx5 transport domain allocation path, engineering conditions under which mlx5_ib_enable_lb() returns an error (e.g., by exhausting loopback table entries or via a race). Each failed attempt leaks one TD object from kernel memory. Iterating this across thousands of attempts could exhaust kernel slab memory, leading to a system-wide denial of service or, if the leaked TD object is reachable, a potential kernel memory disclosure. No public proof-of-concept is identified at time of analysis.