CVE-2026-74396 RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure
A resource leak and mutex lock issue in the Linux kernel RDMA driver can cause denial of service when ODP populate fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74396?
CVE-2026-74396 is a high-severity denial of service vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure
mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_umr_unmap_free_xlt().
After mlx5_odp_populate_xlt() became fallible, its error path returned directly and skipped that cleanup. This leaks the XLT DMA mapping and buffer. If the emergency XLT page was used, it also leaves xlt_emergency_page_mutex locked.
Break out of the loop so execution falls through the existing cleanup path.
Which versions are affected by CVE-2026-74396?
How do I fix CVE-2026-74396?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74396 being exploited?
There is no known exploitation of CVE-2026-74396 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74396, DEBIAN-CVE-2026-74396, GHSA-2vqx-xvhw-m854, UBUNTU-CVE-2026-74396.