CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5e: Use sender devcom for MPV master-up<br /> <br /> After PCIe DPC recovery, mlx5 reloads the affected functions and<br /> replays multiport affiliation events. In the reported failure, the<br /> first relevant device error was:<br /> <br /> pcieport 0000:10:01.1: DPC: containment event<br /> pcieport 0000:10:01.1: PCIe Bus Error: severity=Uncorrected (Fatal)<br /> pcieport 0000:10:01.1: [ 5] SDES (First)<br /> <br /> mlx5 recovered the PCI functions and resumed 0000:11:00.1. During<br /> that resume, RDMA multiport binding replayed<br /> MLX5_DRIVER_EVENT_AFFILIATION_DONE and mlx5e sent<br /> MPV_DEVCOM_MASTER_UP. The host then panicked with:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> RIP: mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core]<br /> RDI: 0000000000000000<br /> <br /> Call trace included:<br /> <br /> mlx5_devcom_comp_set_ready<br /> mlx5e_devcom_event_mpv<br /> mlx5_devcom_send_event<br /> mlx5_ib_bind_slave_port<br /> mlx5r_mp_probe<br /> mlx5_pci_resume<br /> <br /> MPV devcom registration publishes mlx5e private data to the component<br /> peer list before mlx5e_devcom_init_mpv() stores the returned component<br /> device in priv-&gt;devcom. A concurrent master-up event can therefore<br /> reach a peer whose private data is visible but whose priv-&gt;devcom<br /> backpointer is still NULL.<br /> <br /> MPV_DEVCOM_MASTER_UP already carries the sender/master mlx5e private<br /> data as event_data. The ready bit is stored on the shared devcom<br /> component, not on an individual peer. Use the sender devcom when<br /> marking the MPV component ready.<br /> <br /> This preserves the readiness transition while avoiding a NULL<br /> dereference of the peer devcom pointer during affiliation replay after<br /> PCI error recovery.