Riskcovery

CVE-2026-72006

net/mlx5: free mlx5_st_idx_data on final dealloc

State
Published
Severity
Not scored
Published
Aug 15, 2026
Updated
Aug 17, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: free mlx5_st_idx_data on final dealloc

Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time.

When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed.

Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 888a7776f4fb04c19bec70c737c61c2f383c6b1e to before 262da8b6ea03d01ee7ed01ad309e4c89941f6b14Affected
  • 888a7776f4fb04c19bec70c737c61c2f383c6b1e to before 6eb4cf2fa8997f62c11e0006dc010a1fd89c5a75Affected
  • 888a7776f4fb04c19bec70c737c61c2f383c6b1e to before df6134b527a88b3e65ba6ae5073664af091d5fd2Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.