CVE-2026-98217

What it actually does

Use-after-free in the mlx4 InfiniBand driver caused by register_pkey_tree() ignoring registration errors, leaving stale kobject parent pointers that are later passed to kobject_put() during device cleanup.

Why it matters to the business

Systems using mlx4 InfiniBand hardware may experience kernel instability or crashes; in rare cases this memory corruption could be leveraged for local code execution, increasing operational risk on Linux servers with this hardware.

How an attack unfolds

An attacker with local access triggers the error path in pkey sysfs registration for one slave while other slaves succeed, then forces device teardown; the stale pointers are dereferenced during cleanup, resulting in a use-after-free that may allow memory manipulation.

How to fix it

Apply the upstream kernel patch that clears parent pointers after a failed slave tree registration and skips unregistered trees during cleanup; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the patched code path is present by inspecting the mlx4 pkey registration functions for pointer clearing and conditional cleanup skips; test registration failure scenarios to ensure no stale pointers remain.

Typical attack path

1. Obtain local access on a Linux system with mlx4 hardware
2. Induce a partial pkey tree registration failure across slaves
3. Trigger device removal or module unload to invoke cleanup
4. Exploit the resulting use-after-free for privilege escalation or denial of service

How to detect it

Review kernel logs for oops traces referencing mlx4 pkey kobjects or use-after-free warnings during device cleanup; correlate with hardware events involving InfiniBand mlx4 adapters.

What your security team should do

• Prioritize kernel updates on any systems exposing mlx4 IB interfaces
• Monitor for kernel oops or panic logs involving kobject_put in mlx4 paths
• Limit local unprivileged access on high-value mlx4-equipped hosts until patched