Cloudanix VulnDB

CVE-2026-45922

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

May 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in the Linux kernel can slowly use up memory on certain high-speed networking cards, and fixing it requires updating the operating system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing kfree on the error path after kobject_get_path allocates a device path buffer that exceeds the output length in the MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH UVERBS handler, leaving the memory allocated indefinitely.

Why it matters to the business

On systems using RDMA with mlx5 hardware, repeated triggering of the handler can cause gradual kernel memory exhaustion, leading to performance degradation or eventual denial of service without any external network access required.

How an attack unfolds

An attacker with local user privileges invokes the affected RDMA sysfs path method repeatedly with device paths longer than the caller buffer, causing the handler to return -ENOSPC while leaking each allocation; over time this depletes available memory.

How to fix it

Apply the upstream fix that adds kfree to the -ENOSPC error path in the GET_DATA_DIRECT_SYSFS_PATH handler; upgrade to a Linux kernel release containing commit that resolves the leak in RDMA/mlx5.

How to confirm the fix worked

Inspect the source of uverbs_mlx5.c or equivalent for the presence of kfree after the length check failure; confirm the running kernel version includes the memory-leak resolution and monitor slab or kmalloc counters under repeated handler invocation.

Typical attack path

  1. Obtain local shell or process execution on a Linux system with mlx5 RDMA hardware and the vulnerable kernel
  2. Load or ensure the mlx5_ib module is active
  3. Invoke the MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH verb handler with oversized path data
  4. Repeat the call to accumulate leaked allocations until memory pressure appears

How to detect it

Review kernel memory statistics and slabinfo for repeated allocations tied to RDMA sysfs path handling; correlate with process activity that exercises the mlx5_ib UVERBS interface.

What your security team should do

  • Patch affected kernels at the next maintenance window given the local-only attack surface and modest EPSS
  • Restrict unprivileged access to RDMA verbs interfaces via user namespaces or device permissions where feasible
  • Monitor kernel memory usage on RDMA-enabled hosts for unexplained growth in the mlx5_ib allocation paths

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function allocates memory for the device path using kobject_get_path(). If the length of the device path exceeds the output buffer length, the function returns -ENOSPC but does not free the allocated memory, resulting in a memory leak. Add a kfree() call to the error path to ensure the allocated memory is properly freed. Compile tested only. Issue found using a prototype static analysis tool and code review.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities