CVE-2026-74396 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure
mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_umr_unmap_free_xlt().
After mlx5_odp_populate_xlt() became fallible, its error path returned directly and skipped that cleanup. This leaks the XLT DMA mapping and buffer. If the emergency XLT page was used, it also leaves xlt_emergency_page_mutex locked.
Break out of the loop so execution falls through the existing cleanup path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's RDMA mlx5 driver, specifically affecting the mlx5r_umr_update_xlt() function that manages Unified Memory Registration (UMR) XLT (eXtended Layout Table) operations. This flaw represents a memory management issue that occurs during On-Demand Paging (ODP) population processes, creating potential resource exhaustion and system instability conditions.
The technical implementation involves the mlx5r_umr_update_xlt() function which allocates and DMA maps an XLT buffer using the mlx5r_umr_create_xlt() routine. The normal cleanup pathway through mlx5r_umr_unmap_free_xlt() is designed to properly release both the DMA mapping and underlying buffer resources. However, when the mlx5_odp_populate_xlt() function became fallible in its error handling implementation, it introduced a critical path where error conditions bypassed the standard cleanup mechanism entirely.
This vulnerability manifests as resource leakage where XLT DMA mappings and associated buffers remain allocated even after failure conditions occur during ODP population operations. The issue becomes particularly problematic when emergency XLT pages are utilized, as this leaves the xlt_emergency_page_mutex in a locked state, creating potential deadlocks and system-wide blocking conditions that can severely impact system responsiveness.
The operational impact of this vulnerability extends beyond simple memory leakage to encompass broader system stability concerns within RDMA-based networking environments. Attackers could potentially exploit this condition through repeated failure scenarios to exhaust available DMA mapping resources, leading to system crashes or denial of service conditions that affect high-performance computing clusters and data center networking infrastructures. The flaw directly relates to CWE-401 Memory Leak, specifically in the context of DMA buffer management within kernel space drivers.
This vulnerability demonstrates a classic failure in error path handling where exceptional conditions do not properly traverse established cleanup routines. The fix requires breaking out of loops during error conditions to ensure execution falls through to the existing cleanup path, preventing resource leakage and maintaining proper mutex state management. This approach aligns with ATT&CK technique T1070.004 Indicator Removal on Host, as it addresses improper resource cleanup that could be exploited to maintain persistent system instability.
The remediation strategy emphasizes proper error handling implementation where failure paths must ensure all allocated resources are properly released through established cleanup mechanisms. This vulnerability highlights the importance of maintaining consistent resource management practices in kernel drivers, particularly those involving DMA operations and memory mapping functions. The fix ensures that emergency page mutex locking is properly handled even during error conditions, preventing potential deadlock scenarios that could compromise system availability.
Organizations utilizing RDMA networking capabilities should prioritize patching this vulnerability as it affects core memory management operations within the Linux kernel's networking stack. The impact extends to enterprise environments where high-performance computing and low-latency network operations are critical, making proper resource cleanup essential for maintaining system reliability and preventing cascading failures that could affect entire data center operations through resource exhaustion conditions.