CVE-2026-74717— net/mlx5: fw_tracer, return NULL on create error
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： net/mlx5: fw_tracer，在创建出错时返回 NULL Tracer（追踪器）的创建可能因返回 或 （错误指针）而失败。当前代码在设备端存储返回值时未进行检查，且用户代码将 和 视为相同处理方式。这会导致核心转储（core dump）逻辑中出现崩溃，因为该逻辑缺少对 的检查，从而直接解引用导致崩溃，如下方内核堆栈跟踪所示： 修复措施：将 tracer 创建失败时的返回值统一改为仅返回 ，使得调用方只需检查 一种情况即可。
Affected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | fd1483fe1f9fd45fe312adffb0faffa57446690d< 47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0 |
affected |
fd1483fe1f9fd45fe312adffb0faffa57446690d< ee41ea49c4ab0e4015919f52ad23ec251d3b39d3 |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< 04599570c3a18f9ae7aad36825eb46f3dcd2c4e3 |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< 9a416f000285a94c1b723877547981dec8132434 |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< 80094352bd40ba54a33731f9c22872493983ed6d |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< 4aafa600d93e9551c1f24e785d57cbd4adf021d5 |
affected | ||
fd1483fe1f9fd45fe312adffb0faffa57446690d< af39eb111ce6b5eba9c08513b62c4868eb7e7fd5 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/mlx5: fw_tracer, return NULL on create error
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: fw_tracer, return NULL on create error
Tracer creation can fail by returning either NULL or ERR_PTR.
The return value is stored without a check on the device, and users
treat ERR_PTR and NULL the same way.
This also causes a crash in the core dump logic, which is missing the
ERR_PTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only
need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP
Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core
CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)
Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]
pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]
lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]
sp : ffff800081cf3c40
x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000
x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05
x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000
x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0
x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac
x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650
x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8
x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e
Call trace:
mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)
mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]
devlink_health_do_dump+0x9c/0x160
devlink_health_report+0x1c0/0x288
mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]
process_one_work+0x15c/0x3d8
worker_thread+0x18c/0x320
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: b9400000 5ac00800 7a401800 540003ca (3940a260)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x000000,00078031,75fce5a1,35fffe67
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74717
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74717 (8)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-74717
No comments yet