CVE-2026-68139

What it actually does

Race condition during mlx5 multiport affiliation replay after PCIe DPC recovery allows MPV_DEVCOM_MASTER_UP event to dereference a NULL devcom backpointer in mlx5_devcom_comp_set_ready, triggering kernel panic.

Why it matters to the business

Systems using affected Mellanox/NVIDIA ConnectX adapters can experience sudden kernel crashes and reboots during PCI error recovery or RDMA multiport operations, causing unplanned downtime and potential data loss for workloads relying on those interfaces.

How an attack unfolds

An attacker with local access or the ability to induce PCIe containment events on a host with mlx5 hardware triggers the affiliation replay path; a concurrent master-up event reaches a peer whose private data is published but devcom pointer is still uninitialized, resulting in the NULL dereference and crash.

How to fix it

Upgrade to a Linux kernel containing the fix that uses the sender devcom object instead of the peer when marking the MPV component ready; apply the vendor-supplied kernel update for the distribution in use.

How to confirm the fix worked

Confirm the patched kernel is running, reproduce a PCIe DPC recovery sequence under RDMA multiport load, and verify absence of the NULL dereference panic and that mlx5_devcom_comp_set_ready now uses sender-provided devcom.

Typical attack path

1. Induce or wait for PCIe DPC containment event on mlx5 function
2. Allow mlx5 PCI resume and multiport affiliation replay
3. Send or trigger MLX5_DRIVER_EVENT_AFFILIATION_DONE followed by MPV_DEVCOM_MASTER_UP
4. Race window causes mlx5_devcom_comp_set_ready to receive NULL pointer
5. Kernel panics with NULL dereference in mlx5_core

How to detect it

Inspect kernel logs for the specific panic signature involving mlx5_devcom_comp_set_ready, mlx5e_devcom_event_mpv, and mlx5_pci_resume after PCIe DPC events; correlate with RDMA multiport binding activity.

• BUG: kernel NULL pointer dereference, address: 0000000000000010
• RIP: mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core]
• mlx5_devcom_send_event
• mlx5_ib_bind_slave_port
• mlx5r_mp_probe
• mlx5_pci_resume

What your security team should do

• Prioritize kernel updates on all hosts with mlx5 hardware in production RDMA or multiport configurations
• Monitor vendor advisories for the exact backported commit
• Consider isolating or limiting RDMA workloads on unpatched systems until remediation completes
• Test recovery paths in staging environments that include simulated PCIe errors