CVE-2026-90128

vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

In add_direct_chain(), newly allocated direct MR entries are added to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop was incorrectly iterating over mr->head instead of tmp.

Fix by iterating over 'tmp' in the err_alloc cleanup path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	94abbccdf2916cb03f9626f2d36c6e9971490c12 to before c93defccf5eb0a92bdafa43487be6ce0221a2477Affected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before ed3462365636df3bc63e34d7468f4faed3f70a4eAffected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 22d52af9e26a72bdfe2dcfb1419a091de4862cd9Affected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before eeac2ea4ad2654e3f160a9b608d05c9af31433a6Affected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 637d867530daea61898e3346975978b7f67fc2acAffected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 6ca752850de3b8162f030793cc15001aec85c4cfAffected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before c678d04ac9e5a64c2559c43bce273e845fbd09ebAffected 94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 23ae56d9e74c122f95cae71ae3b9fc259fb88446Affected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

94abbccdf2916cb03f9626f2d36c6e9971490c12 to before c93defccf5eb0a92bdafa43487be6ce0221a2477Affected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before ed3462365636df3bc63e34d7468f4faed3f70a4eAffected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 22d52af9e26a72bdfe2dcfb1419a091de4862cd9Affected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before eeac2ea4ad2654e3f160a9b608d05c9af31433a6Affected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 637d867530daea61898e3346975978b7f67fc2acAffected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 6ca752850de3b8162f030793cc15001aec85c4cfAffected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before c678d04ac9e5a64c2559c43bce273e845fbd09ebAffected
94abbccdf2916cb03f9626f2d36c6e9971490c12 to before 23ae56d9e74c122f95cae71ae3b9fc259fb88446Affected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.