CVE-2026-72342 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix HV VHCA stats agent registration race
mlx5e_hv_vhca_stats_create() registers the stats agent through mlx5_hv_vhca_agent_create(). The helper publishes the agent in hv_vhca->agents[type] under agents_lock and immediately schedules an
asynchronous control invalidation on the HV VHCA workqueue before returning to mlx5e.
The asynchronous invalidation invokes the control agent's invalidate callback, which reads the hypervisor control block and forwards the command to mlx5e_hv_vhca_stats_control(). That callback may either:
- call cancel_delayed_work_sync(&priv->stats_agent.work), or - call queue_delayed_work(priv->wq, &sagent->work, sagent->delay).
However, the delayed_work and priv->stats_agent.agent are only initialized after mlx5_hv_vhca_agent_create() returns to mlx5e:
agent = mlx5_hv_vhca_agent_create(...); /* publish + invalidate */ ... priv->stats_agent.agent = agent; /* too late */ INIT_DELAYED_WORK(&priv->stats_agent.work, ...); /* too late */
If the asynchronous control path runs before the two assignments above, it can:
- Operate on an uninitialized delayed_work whose timer.function is NULL. queue_delayed_work() calls add_timer() unconditionally, so when the timer expires the timer softirq invokes a NULL function pointer. - Re-initialize the timer later through INIT_DELAYED_WORK() while the timer is already enqueued in the timer wheel, corrupting the hlist (entry.pprev cleared while the previous bucket node still points at this entry). - When the worker eventually runs, mlx5e_hv_vhca_stats_work() reads sagent->agent (NULL) and dereferences it inside mlx5_hv_vhca_agent_write().
Fix this by:
- Initializing priv->stats_agent.work before invoking mlx5_hv_vhca_agent_create(), so the work is always in a valid state when the control callback observes it. - Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter to mlx5_hv_vhca_agent_create(). The helper writes the agent pointer to *ctx_update before publishing into hv_vhca->agents[]
and triggering the agents_update flow, so any callback subsequently invoked from that flow already sees a valid priv->stats_agent.agent. This avoids having the control callback participate in agent initialization.
While at it, access priv->stats_agent.agent with READ_ONCE()/WRITE_ONCE() for the cross-CPU access with the worker, and clear priv->stats_agent.buf on the agent_create() failure path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's mlx5e driver, specifically in the handling of hypervisor virtual channel agent statistics registration. The issue stems from a race condition during the initialization sequence of the stats agent where asynchronous operations can execute before critical data structures are properly configured. The vulnerability manifests when the mlx5e_hv_vhca_stats_create() function registers a stats agent through mlx5_hv_vhca_agent_create(), which publishes the agent in hv_vhca->agents[type] under agents_lock and immediately schedules an asynchronous control invalidation on the HV VHCA workqueue before returning to mlx5e. This timing issue creates a window where the control callback can execute before the delayed_work structure and agent pointer are properly initialized, leading to potential kernel crashes or memory corruption.
The technical flaw directly relates to improper initialization ordering in concurrent code execution, specifically violating the principle of proper synchronization between asynchronous callbacks and data structure initialization. When the asynchronous invalidation runs before the two critical assignments - priv->stats_agent.agent = agent and INIT_DELAYED_WORK(&priv->stats_agent.work, ...) - it attempts to operate on an uninitialized delayed_work structure with a NULL timer.function pointer. This leads to undefined behavior when add_timer() is called unconditionally by queue_delayed_work(), potentially causing kernel oops or system crashes. Additionally, the timer corruption occurs when INIT_DELAYED_WORK() reinitializes a timer that's already enqueued in the timer wheel, corrupting the hlist data structure through improper pointer management.
The operational impact of this vulnerability is significant as it can cause kernel panics and system instability during network device initialization or configuration changes. The race condition affects the mlx5e driver's ability to properly manage hypervisor virtual channel statistics agents, potentially leading to complete system crashes when the control callback attempts to dereference a NULL agent pointer or execute invalid timer functions. This vulnerability affects systems using Mellanox ConnectX network adapters with hypervisor virtualization capabilities, particularly those implementing HV VHCA (Hypervisor Virtual Channel Agent) functionality for statistics collection and management.
The fix addresses this race condition through multiple defensive measures that align with established security practices and kernel development standards. The primary solution involves initializing priv->stats_agent.work before invoking mlx5_hv_vhca_agent_create(), ensuring the work structure is always in a valid state when observed by control callbacks. Additionally, the implementation adds a struct mlx5_hv_vhca_agent *ctx_update out-parameter to mlx5_hv_vhca_agent_create(), allowing the helper to write the agent pointer to ctx_update before publishing into hv_vhca->agents[] and triggering the agents_update flow. This prevents control callbacks from participating in agent initialization while maintaining proper synchronization between CPU cores accessing shared data structures.
The mitigation strategy also incorporates READ_ONCE()/WRITE_ONCE() access patterns for cross-CPU operations with the worker thread, addressing potential memory ordering issues that could lead to stale data reads or inconsistent state management. Furthermore, the implementation clears priv->stats_agent.buf on the agent_create() failure path to prevent potential information leakage or corrupted state handling during error conditions. This comprehensive fix addresses the underlying race condition while maintaining system stability and security posture consistent with industry standards such as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and follows ATT&CK techniques related to system service manipulation and kernel exploitation through memory corruption vulnerabilities. The solution ensures proper ordering of operations, eliminates undefined behavior in asynchronous execution paths, and provides robust error handling for all code execution scenarios within the mlx5e driver's hypervisor agent management subsystem.