CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc
A memory leak in the Linux kernel mlx5 driver allows attackers to cause denial of service by exhausting kernel memory through repeated RDMA operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72006?
CVE-2026-72006 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: free mlx5_st_idx_data on final dealloc
Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time.
When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed.
Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks.
Which versions are affected by CVE-2026-72006?
How do I fix CVE-2026-72006?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72006 being exploited?
There is no known exploitation of CVE-2026-72006 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72006, DEBIAN-CVE-2026-72006, GHSA-x8q3-8m8p-mx7v, UBUNTU-CVE-2026-72006.