CVE-2026-72343 Linux CVE debrief

Who should care

Linux kernel users, administrators, and developers using the net/mlx5e component should review and apply patches, monitor for potential related vulnerabilities, and consider implementing additional monitoring and logging for the net/mlx5e component. Affected operators, platforms, and security teams should prioritize patching and vulnerability management for Linux kernel deployments, especially those using the net/mlx5e component. Vulnerability management teams should assess the impact of this vulnerability on their Linux kernel deployments and plan for remediation. Security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Linux kernel developers and maintainers should review the provided kernel patches and apply them to affected systems. System administrators and operators should review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Linux distributions and package maintainers should review and apply patches to affected Linux kernel packages. Security researchers and vulnerability management teams should track updates and patches for this vulnerability and assess the impact on their Linux kernel deployments. Linux kernel users and administrators should consider implementing additional monitoring and logging for the net/mlx5e component to detect potential exploitation attempts. Vulnerability management teams should prioritize patching and remediation for Linux kernel deployments using the net/mlx5e component. Security teams should review and apply patches to affected Linux kernel systems and consider implementing compensating controls for exposed systems. Linux kernel developers and maintainers should review and apply patches to affected Linux kernel systems. System administrators and operators should review and apply patches to affected Linux kernel systems and consider implementing additional monitoring and and

Technical summary

The vulnerability is caused by a zero-sized buffer allocation in the mlx5e_hv_vhca_stats_create() function. This is due to priv->stats_nch being zero at the time of allocation, which leads to mlx5e_hv_vhca_stats_buf_size() returning 0. The 'if (!buf)' guard does not catch this, and mlx5e_hv_vhca_stats_create() completes 'successfully' with priv->stats_agent.buf set to ZERO_SIZE_PTR. Later, when channels are opened and the hypervisor enables stats reporting, mlx5e_hv_vhca_stats_work() recomputes buf_len using the new non-zero stats_nch and calls memset(buf, 0, buf_len) on ZERO_SIZE_PTR, causing a fault.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches
• Monitor Linux kernel updates for potential related vulnerabilities
• Consider implementing additional monitoring and logging for net/mlx5e component
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by allocating the buffer based on priv->max_nch, which is set in mlx5e_priv_init() and is the upper bound on stats_nch. A separate helper mlx5e_hv_vhca_stats_buf_max_size() was added to return sizeof(per_ring_stats) * max(max_nch, stats_nch), and used for the kvzalloc() in mlx5e_hv_vhca_stats_create().

Official resources