CVE-2026-98217 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
register_pkey_tree() ignores errors from register_one_pkey_tree() and continues registering the remaining slaves. The per-slave error path has already released the pkey parent kobjects, but their pointers remain stored in the device. A later device cleanup therefore passes the stale pointers to kobject_put(), causing a use-after-free.
Clear the parent pointers after releasing a failed slave tree and skip unregistered trees during device cleanup. This preserves the existing best-effort registration behavior while preventing a second cleanup of the failed tree.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel involves a critical memory management error within the InfiniBand mlx4 driver, specifically affecting the pkey sysfs registration process. The core technical flaw resides in the register_pkey_tree function, which fails to properly handle return codes from the underlying register_one_pkey_tree operation. When this subordinate function encounters an error during the initialization of a specific slave's pkey tree, it proceeds to release the associated parent kobjects to clean up partially allocated resources. However, despite releasing these kernel objects, the driver retains stale pointers to them within its internal device structure. This inconsistency creates a dangerous state where the system believes certain resources are still valid and tracked for future cleanup operations.
The operational impact of this flaw manifests during subsequent device teardown or error handling sequences. When the driver attempts to clean up the device configuration, it iterates through the stored pointers to release remaining resources. Because the pointers were not cleared after the initial failure-induced release, the system inadvertently passes these dangling references to kobject_put. This action triggers a use-after-free condition, as the kernel attempts to interact with memory that has already been freed and potentially reallocated for other purposes. Such an error can lead to unpredictable behavior, including kernel panics, data corruption, or potential privilege escalation if an attacker can influence the allocation of the reused memory region before the invalid access occurs.
From a classification perspective, this vulnerability aligns closely with CWE-416, which describes use-after-free errors resulting from improper handling of object lifecycles and pointer management. The failure to nullify pointers after resource release is a classic example of this category. Furthermore, in the context of attack vectors, while primarily a stability issue, such memory corruption bugs can be leveraged for exploitation techniques categorized under ATT&CK T1203, specifically exploiting vulnerabilities in software applications or drivers to execute arbitrary code. The lack of strict error propagation and state synchronization between resource allocation and deallocation phases represents a significant gap in defensive coding practices within the driver logic.
To mitigate this vulnerability, developers must ensure that any pointer referencing a released kernel object is immediately set to NULL upon failure. This prevents subsequent cleanup routines from attempting to dereference or release already freed memory. Additionally, the device cleanup routine should be updated to check for null pointers before invoking kobject_put, ensuring that only successfully registered and active resources are targeted during teardown. Implementing these changes preserves the existing best-effort registration behavior while eliminating the risk of double-free scenarios. Regular static analysis and dynamic testing with tools like KASAN can help detect such pointer management errors early in the development lifecycle, reinforcing robust memory safety standards within kernel subsystems.