medium 5.5

CVE-2026-22996 json

net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv

published 2026-01-25 9 mo ago modified 2026-11-05 3 d ago also EUVD-2026-4630

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is used to reference the netdev and mdev associated with that struct. Instead, store netdev directly into mlx5e_dev and get mdev from the containing mlx5_adev aux device structure.

This fixes a kernel oops in mlx5e_remove when switchdev mode fails due to change profile failure.

$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12

$ devlink dev reload pci/0000:00:03.0 ==> oops

BUG: kernel NULL pointer dereference, address: 0000000000000520 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_remove+0x68/0x130 RSP: 0018:ffffc900034838f0 EFLAGS: 00010246 RAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10 R10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0 R13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400 FS: 00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0 Call Trace: <TASK> device_release_driver_internal+0x19c/0x200 bus_remove_device+0xc6/0x130 device_del+0x160/0x3d0 ? devl_param_driverinit_value_get+0x2d/0x90 mlx5_detach_device+0x89/0xe0 mlx5_unload_one_devl_locked+0x3a/0x70 mlx5_devlink_reload_down+0xc8/0x220 devlink_reload+0x7d/0x260 devlink_nl_reload_doit+0x45b/0x5a0 genl_family_rcv_msg_doit+0xe8/0x140

Patch / fix

fixed in 1 distros 4 links 4

Linux Linux 6.6.160, 6.12.67, 6.18.7, 6.19

debian ubuntu suse opensuse

linux Debian 13 6.12.69-1
linux Debian 14 6.18.8-1

debian advisories DEBIAN-CVE-2026-22996

linux Ubuntu 24.04 LTS 6.8.0-117.117
linux-aws Ubuntu 24.04 LTS 6.8.0-1055.58
linux-gcp Ubuntu 24.04 LTS 6.8.0-1058.61
linux-gke Ubuntu 24.04 LTS 6.8.0-1054.60
linux-ibm Ubuntu 24.04 LTS 6.8.0-1055.56
linux-azure Ubuntu 24.04 LTS 6.8.0-1056.62
linux-gkeop Ubuntu 24.04 LTS 6.8.0-1041.44
linux-raspi Ubuntu 24.04 LTS 6.8.0-1056.60

ubuntu advisories UBUNTU-CVE-2026-22996

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
kernel-rt Linux Micro 6.2 6.12.0-160000.26.1
kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1
kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1
kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.26.1
kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1.160000.2.7
kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1

suse advisories SUSE-SU-2026:20845-1 SUSE-SU-2026:20876-1 SUSE-SU-2026:20555-1 SUSE-SU-2026:20599-1 SUSE-SU-2026:20615-1 SUSE-SU-2026:20570-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.26.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.26.1

opensuse advisories openSUSE-SU-2026:20287-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22996 updated 2026-11-05 cvss 5.5

kernel: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: no fix available
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 d ago (2026-11-05)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-22996
NVD CVE-2026-22996

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary