PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45922 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's RDMA/mlx5 driver within the UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function. The function allocates memory via kobject_get_path() to store a device path string. When the device path length exceeds the output buffer length, the handler returns -ENOSPC but fails to free the previously allocated memory, resulting in a kernel memory leak. The vulnerability was identified through prototype static analysis tooling and code review, with a fix implemented by adding a kfree() call to the error path. The fix has been compile-tested and backported to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux kernels with Mellanox ConnectX InfiniBand/RDMA adapters, particularly those using direct data placement (DDP) features. Cloud providers and HPC environments with high-throughput RDMA workloads should prioritize kernel updates. Memory leaks in kernel drivers can lead to gradual resource exhaustion requiring system reboots.

Technical summary

The MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH uverb handler in drivers/infiniband/hw/mlx5 allocates a device path string using kobject_get_path(). When the path length exceeds the user-provided output buffer, the function returns -ENOSPC without freeing the allocated string, causing a memory leak. The fix adds kfree() to the error path before returning. Affects systems with Mellanox ConnectX adapters using RDMA direct data placement features.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor Linux distribution security advisories for backported fixes
  • Review systems using Mellanox ConnectX-5/6/7 InfiniBand/RDMA adapters for kernel update availability
  • Consider enabling kernel memory leak detection (KASAN, kmemleak) in test environments to identify similar issues

Evidence notes

The vulnerability description indicates the issue was found using a prototype static analysis tool and code review. The fix adds a kfree() call to the error path when kobject_get_path() returns a path exceeding the output buffer length. Multiple stable kernel commits are referenced, indicating backport activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45922 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45922

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45922 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45922

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9b9d253908478f504297ac283c514e5953ddafa6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b2bc649c18fbe8a7fd38d17266da3dcbfbcc44d2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b3a10eca24fcfe913c0875e620f19596001bd6dc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ee998cdbff6680891b0efd9d6ce53a388e5342c3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.