CVE-2026-74717: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74717 is a null pointer dereference vulnerability in the Linux kernel's net/mlx5 firmware tracer subsystem, caused by inconsistent error handling during tracer creation. The mlx5_fw_tracer creation function can return either NULL or ERR_PTR on failure, but callers and the core dump logic do not handle both error types — the missing ERR_PTR check in the core dump path leads to a kernel crash (Oops/panic) when the erroneous pointer is dereferenced. The vulnerability was introduced at commit fd1483fe1f9f and affects Linux kernel versions from 5.3 up through multiple stable branches. It was published on August 22, 2026, with patches available for affected stable series. Feedly estimates a Medium severity; no official CVSS score has been assigned at time of publication (GitHub Advisory).

The root cause is improper error handling (CWE-476, Null Pointer Dereference) in the mlx5_fw_tracer creation path within the mlx5_core kernel module. When tracer creation fails, the function may return an ERR_PTR value rather than NULL; however, the core dump logic in mlx5_fw_tracer_trigger_core_dump_general only checks for NULL and proceeds to dereference the ERR_PTR value (ffffffffffffffa1 as seen in register x19), triggering a fatal kernel exception. The crash manifests as an Oops: 0000000096000006 on ARM64 systems, with the call trace showing mlx5_fw_tracer_trigger_core_dump_general → mlx5_fw_reporter_dump → devlink_health_report → mlx5_fw_reporter_err_work. The fix standardizes the tracer creation function to return only NULL on failure, so all callers require only a single NULL check (GitHub Advisory).

Successful triggering of this vulnerability causes a kernel panic (Oops: Fatal exception), rendering the affected system completely unresponsive and requiring a reboot. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using Mellanox/NVIDIA mlx5-based network adapters (e.g., ConnectX series) with the mlx5_core module loaded are at risk, particularly in environments where firmware health reporting or core dump operations are triggered (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication. The vulnerability requires local access to trigger firmware tracer core dump operations (e.g., via devlink health reporting), limiting the attack surface to local users or processes with sufficient privileges. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score or threat actor attribution is available (GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing Internal error: Oops: 0000000096000006, mlx5_fw_tracer_trigger_core_dump_general, or Kernel panic - not syncing: Oops: Fatal exception.
• Process: Workqueue thread kworker associated with mlx5_health<PCI_ID> executing mlx5_fw_reporter_err_work at time of crash.
• System: Unexpected system reboots or kernel crash dumps (vmcore) on hosts equipped with mlx5-based NICs running unpatched kernel versions.

Apply the upstream kernel patches that modify tracer creation to return only NULL on failure. Fixed versions across stable branches are: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2 (mainline). Patch commits are available at the kernel stable repository for each affected branch. As a workaround where patching is not immediately possible, avoiding conditions that trigger mlx5 firmware health reporting or core dump operations (e.g., restricting devlink access) may reduce exposure, though upgrading to a patched kernel is the recommended remediation (GitHub Advisory).