CVE-2026-64122

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover<br /> <br /> mlx5e_tx_reporter_timeout_recover() accesses sq-&gt;netdev after<br /> mlx5e_safe_reopen_channels() has torn down and freed the channel (and<br /> its embedded SQs). Replace the three sq-&gt;netdev references with<br /> priv-&gt;netdev which is safe because priv outlives channel teardown.<br /> <br /> The netdev_err() call already used priv-&gt;netdev for this reason; make<br /> the trylock/unlock and health_channel_eq_recover calls consistent.<br /> <br /> This fixes the following KASAN splat:<br /> <br /> BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]<br /> Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277<br /> <br /> Call Trace:<br /> mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core]<br /> devlink_health_reporter_recover+0xa2/0x150<br /> devlink_health_report+0x254/0x7c0<br /> mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core]<br /> mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core]<br /> process_one_work+0x677/0xf20<br /> worker_thread+0x51f/0xd90<br /> kthread+0x3a5/0x810<br /> ret_from_fork+0x208/0x400<br /> ret_from_fork_asm+0x1a/0x30